1//===- SemaChecking.cpp - Extra Semantic Checking -------------------------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file implements extra semantic analysis beyond what is enforced
10// by the C type system.
11//
12//===----------------------------------------------------------------------===//
13
14#include "CheckExprLifetime.h"
15#include "clang/AST/APValue.h"
16#include "clang/AST/ASTContext.h"
17#include "clang/AST/ASTDiagnostic.h"
18#include "clang/AST/Attr.h"
19#include "clang/AST/AttrIterator.h"
20#include "clang/AST/CharUnits.h"
21#include "clang/AST/Decl.h"
22#include "clang/AST/DeclBase.h"
23#include "clang/AST/DeclCXX.h"
24#include "clang/AST/DeclObjC.h"
25#include "clang/AST/DeclarationName.h"
26#include "clang/AST/EvaluatedExprVisitor.h"
27#include "clang/AST/Expr.h"
28#include "clang/AST/ExprCXX.h"
29#include "clang/AST/ExprObjC.h"
30#include "clang/AST/FormatString.h"
31#include "clang/AST/IgnoreExpr.h"
32#include "clang/AST/NSAPI.h"
33#include "clang/AST/NonTrivialTypeVisitor.h"
34#include "clang/AST/OperationKinds.h"
35#include "clang/AST/RecordLayout.h"
36#include "clang/AST/Stmt.h"
37#include "clang/AST/TemplateBase.h"
38#include "clang/AST/Type.h"
39#include "clang/AST/TypeLoc.h"
40#include "clang/AST/UnresolvedSet.h"
41#include "clang/Basic/AddressSpaces.h"
42#include "clang/Basic/Diagnostic.h"
43#include "clang/Basic/IdentifierTable.h"
44#include "clang/Basic/LLVM.h"
45#include "clang/Basic/LangOptions.h"
46#include "clang/Basic/OpenCLOptions.h"
47#include "clang/Basic/OperatorKinds.h"
48#include "clang/Basic/PartialDiagnostic.h"
49#include "clang/Basic/SourceLocation.h"
50#include "clang/Basic/SourceManager.h"
51#include "clang/Basic/Specifiers.h"
52#include "clang/Basic/SyncScope.h"
53#include "clang/Basic/TargetInfo.h"
54#include "clang/Basic/TypeTraits.h"
55#include "clang/Lex/Lexer.h" // TODO: Extract static functions to fix layering.
56#include "clang/Sema/Initialization.h"
57#include "clang/Sema/Lookup.h"
58#include "clang/Sema/Ownership.h"
59#include "clang/Sema/Scope.h"
60#include "clang/Sema/ScopeInfo.h"
61#include "clang/Sema/Sema.h"
62#include "clang/Sema/SemaAMDGPU.h"
63#include "clang/Sema/SemaARM.h"
64#include "clang/Sema/SemaBPF.h"
65#include "clang/Sema/SemaDirectX.h"
66#include "clang/Sema/SemaHLSL.h"
67#include "clang/Sema/SemaHexagon.h"
68#include "clang/Sema/SemaLoongArch.h"
69#include "clang/Sema/SemaMIPS.h"
70#include "clang/Sema/SemaNVPTX.h"
71#include "clang/Sema/SemaObjC.h"
72#include "clang/Sema/SemaOpenCL.h"
73#include "clang/Sema/SemaPPC.h"
74#include "clang/Sema/SemaRISCV.h"
75#include "clang/Sema/SemaSPIRV.h"
76#include "clang/Sema/SemaSystemZ.h"
77#include "clang/Sema/SemaWasm.h"
78#include "clang/Sema/SemaX86.h"
79#include "llvm/ADT/APFloat.h"
80#include "llvm/ADT/APInt.h"
81#include "llvm/ADT/APSInt.h"
82#include "llvm/ADT/ArrayRef.h"
83#include "llvm/ADT/DenseMap.h"
84#include "llvm/ADT/FoldingSet.h"
85#include "llvm/ADT/STLExtras.h"
86#include "llvm/ADT/STLForwardCompat.h"
87#include "llvm/ADT/SmallBitVector.h"
88#include "llvm/ADT/SmallPtrSet.h"
89#include "llvm/ADT/SmallString.h"
90#include "llvm/ADT/SmallVector.h"
91#include "llvm/ADT/StringExtras.h"
92#include "llvm/ADT/StringRef.h"
93#include "llvm/ADT/StringSet.h"
94#include "llvm/ADT/StringSwitch.h"
95#include "llvm/Support/AtomicOrdering.h"
96#include "llvm/Support/Compiler.h"
97#include "llvm/Support/ConvertUTF.h"
98#include "llvm/Support/ErrorHandling.h"
99#include "llvm/Support/Format.h"
100#include "llvm/Support/Locale.h"
101#include "llvm/Support/MathExtras.h"
102#include "llvm/Support/SaveAndRestore.h"
103#include "llvm/Support/raw_ostream.h"
104#include "llvm/TargetParser/RISCVTargetParser.h"
105#include "llvm/TargetParser/Triple.h"
106#include <algorithm>
107#include <cassert>
108#include <cctype>
109#include <cstddef>
110#include <cstdint>
111#include <functional>
112#include <limits>
113#include <optional>
114#include <string>
115#include <tuple>
116#include <utility>
117
118using namespace clang;
119using namespace sema;
120
121SourceLocation Sema::getLocationOfStringLiteralByte(const StringLiteral *SL,
122 unsigned ByteNo) const {
123 return SL->getLocationOfByte(ByteNo, SM: getSourceManager(), Features: LangOpts,
124 Target: Context.getTargetInfo());
125}
126
127static constexpr unsigned short combineFAPK(Sema::FormatArgumentPassingKind A,
128 Sema::FormatArgumentPassingKind B) {
129 return (A << 8) | B;
130}
131
132bool Sema::checkArgCountAtLeast(CallExpr *Call, unsigned MinArgCount) {
133 unsigned ArgCount = Call->getNumArgs();
134 if (ArgCount >= MinArgCount)
135 return false;
136
137 return Diag(Call->getEndLoc(), diag::err_typecheck_call_too_few_args)
138 << 0 /*function call*/ << MinArgCount << ArgCount
139 << /*is non object*/ 0 << Call->getSourceRange();
140}
141
142bool Sema::checkArgCountAtMost(CallExpr *Call, unsigned MaxArgCount) {
143 unsigned ArgCount = Call->getNumArgs();
144 if (ArgCount <= MaxArgCount)
145 return false;
146 return Diag(Call->getEndLoc(), diag::err_typecheck_call_too_many_args_at_most)
147 << 0 /*function call*/ << MaxArgCount << ArgCount
148 << /*is non object*/ 0 << Call->getSourceRange();
149}
150
151bool Sema::checkArgCountRange(CallExpr *Call, unsigned MinArgCount,
152 unsigned MaxArgCount) {
153 return checkArgCountAtLeast(Call, MinArgCount) ||
154 checkArgCountAtMost(Call, MaxArgCount);
155}
156
157bool Sema::checkArgCount(CallExpr *Call, unsigned DesiredArgCount) {
158 unsigned ArgCount = Call->getNumArgs();
159 if (ArgCount == DesiredArgCount)
160 return false;
161
162 if (checkArgCountAtLeast(Call, MinArgCount: DesiredArgCount))
163 return true;
164 assert(ArgCount > DesiredArgCount && "should have diagnosed this");
165
166 // Highlight all the excess arguments.
167 SourceRange Range(Call->getArg(Arg: DesiredArgCount)->getBeginLoc(),
168 Call->getArg(Arg: ArgCount - 1)->getEndLoc());
169
170 return Diag(Range.getBegin(), diag::err_typecheck_call_too_many_args)
171 << 0 /*function call*/ << DesiredArgCount << ArgCount
172 << /*is non object*/ 0 << Range;
173}
174
175static bool checkBuiltinVerboseTrap(CallExpr *Call, Sema &S) {
176 bool HasError = false;
177
178 for (unsigned I = 0; I < Call->getNumArgs(); ++I) {
179 Expr *Arg = Call->getArg(Arg: I);
180
181 if (Arg->isValueDependent())
182 continue;
183
184 std::optional<std::string> ArgString = Arg->tryEvaluateString(Ctx&: S.Context);
185 int DiagMsgKind = -1;
186 // Arguments must be pointers to constant strings and cannot use '$'.
187 if (!ArgString.has_value())
188 DiagMsgKind = 0;
189 else if (ArgString->find(c: '$') != std::string::npos)
190 DiagMsgKind = 1;
191
192 if (DiagMsgKind >= 0) {
193 S.Diag(Arg->getBeginLoc(), diag::err_builtin_verbose_trap_arg)
194 << DiagMsgKind << Arg->getSourceRange();
195 HasError = true;
196 }
197 }
198
199 return !HasError;
200}
201
202static bool convertArgumentToType(Sema &S, Expr *&Value, QualType Ty) {
203 if (Value->isTypeDependent())
204 return false;
205
206 InitializedEntity Entity =
207 InitializedEntity::InitializeParameter(Context&: S.Context, Type: Ty, Consumed: false);
208 ExprResult Result =
209 S.PerformCopyInitialization(Entity, EqualLoc: SourceLocation(), Init: Value);
210 if (Result.isInvalid())
211 return true;
212 Value = Result.get();
213 return false;
214}
215
216/// Check that the first argument to __builtin_annotation is an integer
217/// and the second argument is a non-wide string literal.
218static bool BuiltinAnnotation(Sema &S, CallExpr *TheCall) {
219 if (S.checkArgCount(Call: TheCall, DesiredArgCount: 2))
220 return true;
221
222 // First argument should be an integer.
223 Expr *ValArg = TheCall->getArg(Arg: 0);
224 QualType Ty = ValArg->getType();
225 if (!Ty->isIntegerType()) {
226 S.Diag(ValArg->getBeginLoc(), diag::err_builtin_annotation_first_arg)
227 << ValArg->getSourceRange();
228 return true;
229 }
230
231 // Second argument should be a constant string.
232 Expr *StrArg = TheCall->getArg(Arg: 1)->IgnoreParenCasts();
233 StringLiteral *Literal = dyn_cast<StringLiteral>(Val: StrArg);
234 if (!Literal || !Literal->isOrdinary()) {
235 S.Diag(StrArg->getBeginLoc(), diag::err_builtin_annotation_second_arg)
236 << StrArg->getSourceRange();
237 return true;
238 }
239
240 TheCall->setType(Ty);
241 return false;
242}
243
244static bool BuiltinMSVCAnnotation(Sema &S, CallExpr *TheCall) {
245 // We need at least one argument.
246 if (TheCall->getNumArgs() < 1) {
247 S.Diag(TheCall->getEndLoc(), diag::err_typecheck_call_too_few_args_at_least)
248 << 0 << 1 << TheCall->getNumArgs() << /*is non object*/ 0
249 << TheCall->getCallee()->getSourceRange();
250 return true;
251 }
252
253 // All arguments should be wide string literals.
254 for (Expr *Arg : TheCall->arguments()) {
255 auto *Literal = dyn_cast<StringLiteral>(Val: Arg->IgnoreParenCasts());
256 if (!Literal || !Literal->isWide()) {
257 S.Diag(Arg->getBeginLoc(), diag::err_msvc_annotation_wide_str)
258 << Arg->getSourceRange();
259 return true;
260 }
261 }
262
263 return false;
264}
265
266/// Check that the argument to __builtin_addressof is a glvalue, and set the
267/// result type to the corresponding pointer type.
268static bool BuiltinAddressof(Sema &S, CallExpr *TheCall) {
269 if (S.checkArgCount(Call: TheCall, DesiredArgCount: 1))
270 return true;
271
272 ExprResult Arg(TheCall->getArg(Arg: 0));
273 QualType ResultType = S.CheckAddressOfOperand(Operand&: Arg, OpLoc: TheCall->getBeginLoc());
274 if (ResultType.isNull())
275 return true;
276
277 TheCall->setArg(Arg: 0, ArgExpr: Arg.get());
278 TheCall->setType(ResultType);
279 return false;
280}
281
282/// Check that the argument to __builtin_function_start is a function.
283static bool BuiltinFunctionStart(Sema &S, CallExpr *TheCall) {
284 if (S.checkArgCount(Call: TheCall, DesiredArgCount: 1))
285 return true;
286
287 ExprResult Arg = S.DefaultFunctionArrayLvalueConversion(E: TheCall->getArg(Arg: 0));
288 if (Arg.isInvalid())
289 return true;
290
291 TheCall->setArg(Arg: 0, ArgExpr: Arg.get());
292 const FunctionDecl *FD = dyn_cast_or_null<FunctionDecl>(
293 Val: Arg.get()->getAsBuiltinConstantDeclRef(Context: S.getASTContext()));
294
295 if (!FD) {
296 S.Diag(TheCall->getBeginLoc(), diag::err_function_start_invalid_type)
297 << TheCall->getSourceRange();
298 return true;
299 }
300
301 return !S.checkAddressOfFunctionIsAvailable(Function: FD, /*Complain=*/true,
302 Loc: TheCall->getBeginLoc());
303}
304
305/// Check the number of arguments and set the result type to
306/// the argument type.
307static bool BuiltinPreserveAI(Sema &S, CallExpr *TheCall) {
308 if (S.checkArgCount(Call: TheCall, DesiredArgCount: 1))
309 return true;
310
311 TheCall->setType(TheCall->getArg(Arg: 0)->getType());
312 return false;
313}
314
315/// Check that the value argument for __builtin_is_aligned(value, alignment) and
316/// __builtin_aligned_{up,down}(value, alignment) is an integer or a pointer
317/// type (but not a function pointer) and that the alignment is a power-of-two.
318static bool BuiltinAlignment(Sema &S, CallExpr *TheCall, unsigned ID) {
319 if (S.checkArgCount(Call: TheCall, DesiredArgCount: 2))
320 return true;
321
322 clang::Expr *Source = TheCall->getArg(Arg: 0);
323 bool IsBooleanAlignBuiltin = ID == Builtin::BI__builtin_is_aligned;
324
325 auto IsValidIntegerType = [](QualType Ty) {
326 return Ty->isIntegerType() && !Ty->isEnumeralType() && !Ty->isBooleanType();
327 };
328 QualType SrcTy = Source->getType();
329 // We should also be able to use it with arrays (but not functions!).
330 if (SrcTy->canDecayToPointerType() && SrcTy->isArrayType()) {
331 SrcTy = S.Context.getDecayedType(T: SrcTy);
332 }
333 if ((!SrcTy->isPointerType() && !IsValidIntegerType(SrcTy)) ||
334 SrcTy->isFunctionPointerType()) {
335 // FIXME: this is not quite the right error message since we don't allow
336 // floating point types, or member pointers.
337 S.Diag(Source->getExprLoc(), diag::err_typecheck_expect_scalar_operand)
338 << SrcTy;
339 return true;
340 }
341
342 clang::Expr *AlignOp = TheCall->getArg(Arg: 1);
343 if (!IsValidIntegerType(AlignOp->getType())) {
344 S.Diag(AlignOp->getExprLoc(), diag::err_typecheck_expect_int)
345 << AlignOp->getType();
346 return true;
347 }
348 Expr::EvalResult AlignResult;
349 unsigned MaxAlignmentBits = S.Context.getIntWidth(T: SrcTy) - 1;
350 // We can't check validity of alignment if it is value dependent.
351 if (!AlignOp->isValueDependent() &&
352 AlignOp->EvaluateAsInt(Result&: AlignResult, Ctx: S.Context,
353 AllowSideEffects: Expr::SE_AllowSideEffects)) {
354 llvm::APSInt AlignValue = AlignResult.Val.getInt();
355 llvm::APSInt MaxValue(
356 llvm::APInt::getOneBitSet(numBits: MaxAlignmentBits + 1, BitNo: MaxAlignmentBits));
357 if (AlignValue < 1) {
358 S.Diag(AlignOp->getExprLoc(), diag::err_alignment_too_small) << 1;
359 return true;
360 }
361 if (llvm::APSInt::compareValues(I1: AlignValue, I2: MaxValue) > 0) {
362 S.Diag(AlignOp->getExprLoc(), diag::err_alignment_too_big)
363 << toString(MaxValue, 10);
364 return true;
365 }
366 if (!AlignValue.isPowerOf2()) {
367 S.Diag(AlignOp->getExprLoc(), diag::err_alignment_not_power_of_two);
368 return true;
369 }
370 if (AlignValue == 1) {
371 S.Diag(AlignOp->getExprLoc(), diag::warn_alignment_builtin_useless)
372 << IsBooleanAlignBuiltin;
373 }
374 }
375
376 ExprResult SrcArg = S.PerformCopyInitialization(
377 Entity: InitializedEntity::InitializeParameter(Context&: S.Context, Type: SrcTy, Consumed: false),
378 EqualLoc: SourceLocation(), Init: Source);
379 if (SrcArg.isInvalid())
380 return true;
381 TheCall->setArg(Arg: 0, ArgExpr: SrcArg.get());
382 ExprResult AlignArg =
383 S.PerformCopyInitialization(Entity: InitializedEntity::InitializeParameter(
384 Context&: S.Context, Type: AlignOp->getType(), Consumed: false),
385 EqualLoc: SourceLocation(), Init: AlignOp);
386 if (AlignArg.isInvalid())
387 return true;
388 TheCall->setArg(Arg: 1, ArgExpr: AlignArg.get());
389 // For align_up/align_down, the return type is the same as the (potentially
390 // decayed) argument type including qualifiers. For is_aligned(), the result
391 // is always bool.
392 TheCall->setType(IsBooleanAlignBuiltin ? S.Context.BoolTy : SrcTy);
393 return false;
394}
395
396static bool BuiltinOverflow(Sema &S, CallExpr *TheCall, unsigned BuiltinID) {
397 if (S.checkArgCount(Call: TheCall, DesiredArgCount: 3))
398 return true;
399
400 std::pair<unsigned, const char *> Builtins[] = {
401 { Builtin::BI__builtin_add_overflow, "ckd_add" },
402 { Builtin::BI__builtin_sub_overflow, "ckd_sub" },
403 { Builtin::BI__builtin_mul_overflow, "ckd_mul" },
404 };
405
406 bool CkdOperation = llvm::any_of(Range&: Builtins, P: [&](const std::pair<unsigned,
407 const char *> &P) {
408 return BuiltinID == P.first && TheCall->getExprLoc().isMacroID() &&
409 Lexer::getImmediateMacroName(TheCall->getExprLoc(),
410 S.getSourceManager(), S.getLangOpts()) == P.second;
411 });
412
413 auto ValidCkdIntType = [](QualType QT) {
414 // A valid checked integer type is an integer type other than a plain char,
415 // bool, a bit-precise type, or an enumeration type.
416 if (const auto *BT = QT.getCanonicalType()->getAs<BuiltinType>())
417 return (BT->getKind() >= BuiltinType::Short &&
418 BT->getKind() <= BuiltinType::Int128) || (
419 BT->getKind() >= BuiltinType::UShort &&
420 BT->getKind() <= BuiltinType::UInt128) ||
421 BT->getKind() == BuiltinType::UChar ||
422 BT->getKind() == BuiltinType::SChar;
423 return false;
424 };
425
426 // First two arguments should be integers.
427 for (unsigned I = 0; I < 2; ++I) {
428 ExprResult Arg = S.DefaultFunctionArrayLvalueConversion(E: TheCall->getArg(Arg: I));
429 if (Arg.isInvalid()) return true;
430 TheCall->setArg(Arg: I, ArgExpr: Arg.get());
431
432 QualType Ty = Arg.get()->getType();
433 bool IsValid = CkdOperation ? ValidCkdIntType(Ty) : Ty->isIntegerType();
434 if (!IsValid) {
435 S.Diag(Arg.get()->getBeginLoc(), diag::err_overflow_builtin_must_be_int)
436 << CkdOperation << Ty << Arg.get()->getSourceRange();
437 return true;
438 }
439 }
440
441 // Third argument should be a pointer to a non-const integer.
442 // IRGen correctly handles volatile, restrict, and address spaces, and
443 // the other qualifiers aren't possible.
444 {
445 ExprResult Arg = S.DefaultFunctionArrayLvalueConversion(E: TheCall->getArg(Arg: 2));
446 if (Arg.isInvalid()) return true;
447 TheCall->setArg(Arg: 2, ArgExpr: Arg.get());
448
449 QualType Ty = Arg.get()->getType();
450 const auto *PtrTy = Ty->getAs<PointerType>();
451 if (!PtrTy ||
452 !PtrTy->getPointeeType()->isIntegerType() ||
453 (!ValidCkdIntType(PtrTy->getPointeeType()) && CkdOperation) ||
454 PtrTy->getPointeeType().isConstQualified()) {
455 S.Diag(Arg.get()->getBeginLoc(),
456 diag::err_overflow_builtin_must_be_ptr_int)
457 << CkdOperation << Ty << Arg.get()->getSourceRange();
458 return true;
459 }
460 }
461
462 // Disallow signed bit-precise integer args larger than 128 bits to mul
463 // function until we improve backend support.
464 if (BuiltinID == Builtin::BI__builtin_mul_overflow) {
465 for (unsigned I = 0; I < 3; ++I) {
466 const auto Arg = TheCall->getArg(Arg: I);
467 // Third argument will be a pointer.
468 auto Ty = I < 2 ? Arg->getType() : Arg->getType()->getPointeeType();
469 if (Ty->isBitIntType() && Ty->isSignedIntegerType() &&
470 S.getASTContext().getIntWidth(Ty) > 128)
471 return S.Diag(Arg->getBeginLoc(),
472 diag::err_overflow_builtin_bit_int_max_size)
473 << 128;
474 }
475 }
476
477 return false;
478}
479
480namespace {
481struct BuiltinDumpStructGenerator {
482 Sema &S;
483 CallExpr *TheCall;
484 SourceLocation Loc = TheCall->getBeginLoc();
485 SmallVector<Expr *, 32> Actions;
486 DiagnosticErrorTrap ErrorTracker;
487 PrintingPolicy Policy;
488
489 BuiltinDumpStructGenerator(Sema &S, CallExpr *TheCall)
490 : S(S), TheCall(TheCall), ErrorTracker(S.getDiagnostics()),
491 Policy(S.Context.getPrintingPolicy()) {
492 Policy.AnonymousTagLocations = false;
493 }
494
495 Expr *makeOpaqueValueExpr(Expr *Inner) {
496 auto *OVE = new (S.Context)
497 OpaqueValueExpr(Loc, Inner->getType(), Inner->getValueKind(),
498 Inner->getObjectKind(), Inner);
499 Actions.push_back(OVE);
500 return OVE;
501 }
502
503 Expr *getStringLiteral(llvm::StringRef Str) {
504 Expr *Lit = S.Context.getPredefinedStringLiteralFromCache(Key: Str);
505 // Wrap the literal in parentheses to attach a source location.
506 return new (S.Context) ParenExpr(Loc, Loc, Lit);
507 }
508
509 bool callPrintFunction(llvm::StringRef Format,
510 llvm::ArrayRef<Expr *> Exprs = {}) {
511 SmallVector<Expr *, 8> Args;
512 assert(TheCall->getNumArgs() >= 2);
513 Args.reserve(N: (TheCall->getNumArgs() - 2) + /*Format*/ 1 + Exprs.size());
514 Args.assign(TheCall->arg_begin() + 2, TheCall->arg_end());
515 Args.push_back(Elt: getStringLiteral(Str: Format));
516 llvm::append_range(C&: Args, R&: Exprs);
517
518 // Register a note to explain why we're performing the call.
519 Sema::CodeSynthesisContext Ctx;
520 Ctx.Kind = Sema::CodeSynthesisContext::BuildingBuiltinDumpStructCall;
521 Ctx.PointOfInstantiation = Loc;
522 Ctx.CallArgs = Args.data();
523 Ctx.NumCallArgs = Args.size();
524 S.pushCodeSynthesisContext(Ctx);
525
526 ExprResult RealCall =
527 S.BuildCallExpr(/*Scope=*/S: nullptr, Fn: TheCall->getArg(Arg: 1),
528 LParenLoc: TheCall->getBeginLoc(), ArgExprs: Args, RParenLoc: TheCall->getRParenLoc());
529
530 S.popCodeSynthesisContext();
531 if (!RealCall.isInvalid())
532 Actions.push_back(Elt: RealCall.get());
533 // Bail out if we've hit any errors, even if we managed to build the
534 // call. We don't want to produce more than one error.
535 return RealCall.isInvalid() || ErrorTracker.hasErrorOccurred();
536 }
537
538 Expr *getIndentString(unsigned Depth) {
539 if (!Depth)
540 return nullptr;
541
542 llvm::SmallString<32> Indent;
543 Indent.resize(N: Depth * Policy.Indentation, NV: ' ');
544 return getStringLiteral(Str: Indent);
545 }
546
547 Expr *getTypeString(QualType T) {
548 return getStringLiteral(Str: T.getAsString(Policy));
549 }
550
551 bool appendFormatSpecifier(QualType T, llvm::SmallVectorImpl<char> &Str) {
552 llvm::raw_svector_ostream OS(Str);
553
554 // Format 'bool', 'char', 'signed char', 'unsigned char' as numbers, rather
555 // than trying to print a single character.
556 if (auto *BT = T->getAs<BuiltinType>()) {
557 switch (BT->getKind()) {
558 case BuiltinType::Bool:
559 OS << "%d";
560 return true;
561 case BuiltinType::Char_U:
562 case BuiltinType::UChar:
563 OS << "%hhu";
564 return true;
565 case BuiltinType::Char_S:
566 case BuiltinType::SChar:
567 OS << "%hhd";
568 return true;
569 default:
570 break;
571 }
572 }
573
574 analyze_printf::PrintfSpecifier Specifier;
575 if (Specifier.fixType(QT: T, LangOpt: S.getLangOpts(), Ctx&: S.Context, /*IsObjCLiteral=*/false)) {
576 // We were able to guess how to format this.
577 if (Specifier.getConversionSpecifier().getKind() ==
578 analyze_printf::PrintfConversionSpecifier::sArg) {
579 // Wrap double-quotes around a '%s' specifier and limit its maximum
580 // length. Ideally we'd also somehow escape special characters in the
581 // contents but printf doesn't support that.
582 // FIXME: '%s' formatting is not safe in general.
583 OS << '"';
584 Specifier.setPrecision(analyze_printf::OptionalAmount(32u));
585 Specifier.toString(os&: OS);
586 OS << '"';
587 // FIXME: It would be nice to include a '...' if the string doesn't fit
588 // in the length limit.
589 } else {
590 Specifier.toString(os&: OS);
591 }
592 return true;
593 }
594
595 if (T->isPointerType()) {
596 // Format all pointers with '%p'.
597 OS << "%p";
598 return true;
599 }
600
601 return false;
602 }
603
604 bool dumpUnnamedRecord(const RecordDecl *RD, Expr *E, unsigned Depth) {
605 Expr *IndentLit = getIndentString(Depth);
606 Expr *TypeLit = getTypeString(T: S.Context.getRecordType(Decl: RD));
607 if (IndentLit ? callPrintFunction(Format: "%s%s", Exprs: {IndentLit, TypeLit})
608 : callPrintFunction(Format: "%s", Exprs: {TypeLit}))
609 return true;
610
611 return dumpRecordValue(RD, E, RecordIndent: IndentLit, Depth);
612 }
613
614 // Dump a record value. E should be a pointer or lvalue referring to an RD.
615 bool dumpRecordValue(const RecordDecl *RD, Expr *E, Expr *RecordIndent,
616 unsigned Depth) {
617 // FIXME: Decide what to do if RD is a union. At least we should probably
618 // turn off printing `const char*` members with `%s`, because that is very
619 // likely to crash if that's not the active member. Whatever we decide, we
620 // should document it.
621
622 // Build an OpaqueValueExpr so we can refer to E more than once without
623 // triggering re-evaluation.
624 Expr *RecordArg = makeOpaqueValueExpr(Inner: E);
625 bool RecordArgIsPtr = RecordArg->getType()->isPointerType();
626
627 if (callPrintFunction(Format: " {\n"))
628 return true;
629
630 // Dump each base class, regardless of whether they're aggregates.
631 if (const auto *CXXRD = dyn_cast<CXXRecordDecl>(Val: RD)) {
632 for (const auto &Base : CXXRD->bases()) {
633 QualType BaseType =
634 RecordArgIsPtr ? S.Context.getPointerType(T: Base.getType())
635 : S.Context.getLValueReferenceType(T: Base.getType());
636 ExprResult BasePtr = S.BuildCStyleCastExpr(
637 LParenLoc: Loc, Ty: S.Context.getTrivialTypeSourceInfo(T: BaseType, Loc), RParenLoc: Loc,
638 Op: RecordArg);
639 if (BasePtr.isInvalid() ||
640 dumpUnnamedRecord(RD: Base.getType()->getAsRecordDecl(), E: BasePtr.get(),
641 Depth: Depth + 1))
642 return true;
643 }
644 }
645
646 Expr *FieldIndentArg = getIndentString(Depth: Depth + 1);
647
648 // Dump each field.
649 for (auto *D : RD->decls()) {
650 auto *IFD = dyn_cast<IndirectFieldDecl>(D);
651 auto *FD = IFD ? IFD->getAnonField() : dyn_cast<FieldDecl>(D);
652 if (!FD || FD->isUnnamedBitField() || FD->isAnonymousStructOrUnion())
653 continue;
654
655 llvm::SmallString<20> Format = llvm::StringRef("%s%s %s ");
656 llvm::SmallVector<Expr *, 5> Args = {FieldIndentArg,
657 getTypeString(FD->getType()),
658 getStringLiteral(FD->getName())};
659
660 if (FD->isBitField()) {
661 Format += ": %zu ";
662 QualType SizeT = S.Context.getSizeType();
663 llvm::APInt BitWidth(S.Context.getIntWidth(SizeT),
664 FD->getBitWidthValue());
665 Args.push_back(IntegerLiteral::Create(S.Context, BitWidth, SizeT, Loc));
666 }
667
668 Format += "=";
669
670 ExprResult Field =
671 IFD ? S.BuildAnonymousStructUnionMemberReference(
672 CXXScopeSpec(), Loc, IFD,
673 DeclAccessPair::make(IFD, AS_public), RecordArg, Loc)
674 : S.BuildFieldReferenceExpr(
675 RecordArg, RecordArgIsPtr, Loc, CXXScopeSpec(), FD,
676 DeclAccessPair::make(FD, AS_public),
677 DeclarationNameInfo(FD->getDeclName(), Loc));
678 if (Field.isInvalid())
679 return true;
680
681 auto *InnerRD = FD->getType()->getAsRecordDecl();
682 auto *InnerCXXRD = dyn_cast_or_null<CXXRecordDecl>(InnerRD);
683 if (InnerRD && (!InnerCXXRD || InnerCXXRD->isAggregate())) {
684 // Recursively print the values of members of aggregate record type.
685 if (callPrintFunction(Format, Args) ||
686 dumpRecordValue(InnerRD, Field.get(), FieldIndentArg, Depth + 1))
687 return true;
688 } else {
689 Format += " ";
690 if (appendFormatSpecifier(FD->getType(), Format)) {
691 // We know how to print this field.
692 Args.push_back(Field.get());
693 } else {
694 // We don't know how to print this field. Print out its address
695 // with a format specifier that a smart tool will be able to
696 // recognize and treat specially.
697 Format += "*%p";
698 ExprResult FieldAddr =
699 S.BuildUnaryOp(nullptr, Loc, UO_AddrOf, Field.get());
700 if (FieldAddr.isInvalid())
701 return true;
702 Args.push_back(FieldAddr.get());
703 }
704 Format += "\n";
705 if (callPrintFunction(Format, Args))
706 return true;
707 }
708 }
709
710 return RecordIndent ? callPrintFunction(Format: "%s}\n", Exprs: RecordIndent)
711 : callPrintFunction(Format: "}\n");
712 }
713
714 Expr *buildWrapper() {
715 auto *Wrapper = PseudoObjectExpr::Create(S.Context, TheCall, Actions,
716 PseudoObjectExpr::NoResult);
717 TheCall->setType(Wrapper->getType());
718 TheCall->setValueKind(Wrapper->getValueKind());
719 return Wrapper;
720 }
721};
722} // namespace
723
724static ExprResult BuiltinDumpStruct(Sema &S, CallExpr *TheCall) {
725 if (S.checkArgCountAtLeast(Call: TheCall, MinArgCount: 2))
726 return ExprError();
727
728 ExprResult PtrArgResult = S.DefaultLvalueConversion(E: TheCall->getArg(Arg: 0));
729 if (PtrArgResult.isInvalid())
730 return ExprError();
731 TheCall->setArg(Arg: 0, ArgExpr: PtrArgResult.get());
732
733 // First argument should be a pointer to a struct.
734 QualType PtrArgType = PtrArgResult.get()->getType();
735 if (!PtrArgType->isPointerType() ||
736 !PtrArgType->getPointeeType()->isRecordType()) {
737 S.Diag(PtrArgResult.get()->getBeginLoc(),
738 diag::err_expected_struct_pointer_argument)
739 << 1 << TheCall->getDirectCallee() << PtrArgType;
740 return ExprError();
741 }
742 QualType Pointee = PtrArgType->getPointeeType();
743 const RecordDecl *RD = Pointee->getAsRecordDecl();
744 // Try to instantiate the class template as appropriate; otherwise, access to
745 // its data() may lead to a crash.
746 if (S.RequireCompleteType(PtrArgResult.get()->getBeginLoc(), Pointee,
747 diag::err_incomplete_type))
748 return ExprError();
749 // Second argument is a callable, but we can't fully validate it until we try
750 // calling it.
751 QualType FnArgType = TheCall->getArg(Arg: 1)->getType();
752 if (!FnArgType->isFunctionType() && !FnArgType->isFunctionPointerType() &&
753 !FnArgType->isBlockPointerType() &&
754 !(S.getLangOpts().CPlusPlus && FnArgType->isRecordType())) {
755 auto *BT = FnArgType->getAs<BuiltinType>();
756 switch (BT ? BT->getKind() : BuiltinType::Void) {
757 case BuiltinType::Dependent:
758 case BuiltinType::Overload:
759 case BuiltinType::BoundMember:
760 case BuiltinType::PseudoObject:
761 case BuiltinType::UnknownAny:
762 case BuiltinType::BuiltinFn:
763 // This might be a callable.
764 break;
765
766 default:
767 S.Diag(TheCall->getArg(1)->getBeginLoc(),
768 diag::err_expected_callable_argument)
769 << 2 << TheCall->getDirectCallee() << FnArgType;
770 return ExprError();
771 }
772 }
773
774 BuiltinDumpStructGenerator Generator(S, TheCall);
775
776 // Wrap parentheses around the given pointer. This is not necessary for
777 // correct code generation, but it means that when we pretty-print the call
778 // arguments in our diagnostics we will produce '(&s)->n' instead of the
779 // incorrect '&s->n'.
780 Expr *PtrArg = PtrArgResult.get();
781 PtrArg = new (S.Context)
782 ParenExpr(PtrArg->getBeginLoc(),
783 S.getLocForEndOfToken(Loc: PtrArg->getEndLoc()), PtrArg);
784 if (Generator.dumpUnnamedRecord(RD, E: PtrArg, Depth: 0))
785 return ExprError();
786
787 return Generator.buildWrapper();
788}
789
790static bool BuiltinCallWithStaticChain(Sema &S, CallExpr *BuiltinCall) {
791 if (S.checkArgCount(Call: BuiltinCall, DesiredArgCount: 2))
792 return true;
793
794 SourceLocation BuiltinLoc = BuiltinCall->getBeginLoc();
795 Expr *Builtin = BuiltinCall->getCallee()->IgnoreImpCasts();
796 Expr *Call = BuiltinCall->getArg(Arg: 0);
797 Expr *Chain = BuiltinCall->getArg(Arg: 1);
798
799 if (Call->getStmtClass() != Stmt::CallExprClass) {
800 S.Diag(BuiltinLoc, diag::err_first_argument_to_cwsc_not_call)
801 << Call->getSourceRange();
802 return true;
803 }
804
805 auto CE = cast<CallExpr>(Val: Call);
806 if (CE->getCallee()->getType()->isBlockPointerType()) {
807 S.Diag(BuiltinLoc, diag::err_first_argument_to_cwsc_block_call)
808 << Call->getSourceRange();
809 return true;
810 }
811
812 const Decl *TargetDecl = CE->getCalleeDecl();
813 if (const FunctionDecl *FD = dyn_cast_or_null<FunctionDecl>(Val: TargetDecl))
814 if (FD->getBuiltinID()) {
815 S.Diag(BuiltinLoc, diag::err_first_argument_to_cwsc_builtin_call)
816 << Call->getSourceRange();
817 return true;
818 }
819
820 if (isa<CXXPseudoDestructorExpr>(Val: CE->getCallee()->IgnoreParens())) {
821 S.Diag(BuiltinLoc, diag::err_first_argument_to_cwsc_pdtor_call)
822 << Call->getSourceRange();
823 return true;
824 }
825
826 ExprResult ChainResult = S.UsualUnaryConversions(E: Chain);
827 if (ChainResult.isInvalid())
828 return true;
829 if (!ChainResult.get()->getType()->isPointerType()) {
830 S.Diag(BuiltinLoc, diag::err_second_argument_to_cwsc_not_pointer)
831 << Chain->getSourceRange();
832 return true;
833 }
834
835 QualType ReturnTy = CE->getCallReturnType(Ctx: S.Context);
836 QualType ArgTys[2] = { ReturnTy, ChainResult.get()->getType() };
837 QualType BuiltinTy = S.Context.getFunctionType(
838 ResultTy: ReturnTy, Args: ArgTys, EPI: FunctionProtoType::ExtProtoInfo());
839 QualType BuiltinPtrTy = S.Context.getPointerType(T: BuiltinTy);
840
841 Builtin =
842 S.ImpCastExprToType(E: Builtin, Type: BuiltinPtrTy, CK: CK_BuiltinFnToFnPtr).get();
843
844 BuiltinCall->setType(CE->getType());
845 BuiltinCall->setValueKind(CE->getValueKind());
846 BuiltinCall->setObjectKind(CE->getObjectKind());
847 BuiltinCall->setCallee(Builtin);
848 BuiltinCall->setArg(Arg: 1, ArgExpr: ChainResult.get());
849
850 return false;
851}
852
853namespace {
854
855class ScanfDiagnosticFormatHandler
856 : public analyze_format_string::FormatStringHandler {
857 // Accepts the argument index (relative to the first destination index) of the
858 // argument whose size we want.
859 using ComputeSizeFunction =
860 llvm::function_ref<std::optional<llvm::APSInt>(unsigned)>;
861
862 // Accepts the argument index (relative to the first destination index), the
863 // destination size, and the source size).
864 using DiagnoseFunction =
865 llvm::function_ref<void(unsigned, unsigned, unsigned)>;
866
867 ComputeSizeFunction ComputeSizeArgument;
868 DiagnoseFunction Diagnose;
869
870public:
871 ScanfDiagnosticFormatHandler(ComputeSizeFunction ComputeSizeArgument,
872 DiagnoseFunction Diagnose)
873 : ComputeSizeArgument(ComputeSizeArgument), Diagnose(Diagnose) {}
874
875 bool HandleScanfSpecifier(const analyze_scanf::ScanfSpecifier &FS,
876 const char *StartSpecifier,
877 unsigned specifierLen) override {
878 if (!FS.consumesDataArgument())
879 return true;
880
881 unsigned NulByte = 0;
882 switch ((FS.getConversionSpecifier().getKind())) {
883 default:
884 return true;
885 case analyze_format_string::ConversionSpecifier::sArg:
886 case analyze_format_string::ConversionSpecifier::ScanListArg:
887 NulByte = 1;
888 break;
889 case analyze_format_string::ConversionSpecifier::cArg:
890 break;
891 }
892
893 analyze_format_string::OptionalAmount FW = FS.getFieldWidth();
894 if (FW.getHowSpecified() !=
895 analyze_format_string::OptionalAmount::HowSpecified::Constant)
896 return true;
897
898 unsigned SourceSize = FW.getConstantAmount() + NulByte;
899
900 std::optional<llvm::APSInt> DestSizeAPS =
901 ComputeSizeArgument(FS.getArgIndex());
902 if (!DestSizeAPS)
903 return true;
904
905 unsigned DestSize = DestSizeAPS->getZExtValue();
906
907 if (DestSize < SourceSize)
908 Diagnose(FS.getArgIndex(), DestSize, SourceSize);
909
910 return true;
911 }
912};
913
914class EstimateSizeFormatHandler
915 : public analyze_format_string::FormatStringHandler {
916 size_t Size;
917 /// Whether the format string contains Linux kernel's format specifier
918 /// extension.
919 bool IsKernelCompatible = true;
920
921public:
922 EstimateSizeFormatHandler(StringRef Format)
923 : Size(std::min(a: Format.find(C: 0), b: Format.size()) +
924 1 /* null byte always written by sprintf */) {}
925
926 bool HandlePrintfSpecifier(const analyze_printf::PrintfSpecifier &FS,
927 const char *, unsigned SpecifierLen,
928 const TargetInfo &) override {
929
930 const size_t FieldWidth = computeFieldWidth(FS);
931 const size_t Precision = computePrecision(FS);
932
933 // The actual format.
934 switch (FS.getConversionSpecifier().getKind()) {
935 // Just a char.
936 case analyze_format_string::ConversionSpecifier::cArg:
937 case analyze_format_string::ConversionSpecifier::CArg:
938 Size += std::max(a: FieldWidth, b: (size_t)1);
939 break;
940 // Just an integer.
941 case analyze_format_string::ConversionSpecifier::dArg:
942 case analyze_format_string::ConversionSpecifier::DArg:
943 case analyze_format_string::ConversionSpecifier::iArg:
944 case analyze_format_string::ConversionSpecifier::oArg:
945 case analyze_format_string::ConversionSpecifier::OArg:
946 case analyze_format_string::ConversionSpecifier::uArg:
947 case analyze_format_string::ConversionSpecifier::UArg:
948 case analyze_format_string::ConversionSpecifier::xArg:
949 case analyze_format_string::ConversionSpecifier::XArg:
950 Size += std::max(a: FieldWidth, b: Precision);
951 break;
952
953 // %g style conversion switches between %f or %e style dynamically.
954 // %g removes trailing zeros, and does not print decimal point if there are
955 // no digits that follow it. Thus %g can print a single digit.
956 // FIXME: If it is alternative form:
957 // For g and G conversions, trailing zeros are not removed from the result.
958 case analyze_format_string::ConversionSpecifier::gArg:
959 case analyze_format_string::ConversionSpecifier::GArg:
960 Size += 1;
961 break;
962
963 // Floating point number in the form '[+]ddd.ddd'.
964 case analyze_format_string::ConversionSpecifier::fArg:
965 case analyze_format_string::ConversionSpecifier::FArg:
966 Size += std::max(a: FieldWidth, b: 1 /* integer part */ +
967 (Precision ? 1 + Precision
968 : 0) /* period + decimal */);
969 break;
970
971 // Floating point number in the form '[-]d.ddde[+-]dd'.
972 case analyze_format_string::ConversionSpecifier::eArg:
973 case analyze_format_string::ConversionSpecifier::EArg:
974 Size +=
975 std::max(a: FieldWidth,
976 b: 1 /* integer part */ +
977 (Precision ? 1 + Precision : 0) /* period + decimal */ +
978 1 /* e or E letter */ + 2 /* exponent */);
979 break;
980
981 // Floating point number in the form '[-]0xh.hhhhp±dd'.
982 case analyze_format_string::ConversionSpecifier::aArg:
983 case analyze_format_string::ConversionSpecifier::AArg:
984 Size +=
985 std::max(a: FieldWidth,
986 b: 2 /* 0x */ + 1 /* integer part */ +
987 (Precision ? 1 + Precision : 0) /* period + decimal */ +
988 1 /* p or P letter */ + 1 /* + or - */ + 1 /* value */);
989 break;
990
991 // Just a string.
992 case analyze_format_string::ConversionSpecifier::sArg:
993 case analyze_format_string::ConversionSpecifier::SArg:
994 Size += FieldWidth;
995 break;
996
997 // Just a pointer in the form '0xddd'.
998 case analyze_format_string::ConversionSpecifier::pArg:
999 // Linux kernel has its own extesion for `%p` specifier.
1000 // Kernel Document:
1001 // https://docs.kernel.org/core-api/printk-formats.html#pointer-types
1002 IsKernelCompatible = false;
1003 Size += std::max(a: FieldWidth, b: 2 /* leading 0x */ + Precision);
1004 break;
1005
1006 // A plain percent.
1007 case analyze_format_string::ConversionSpecifier::PercentArg:
1008 Size += 1;
1009 break;
1010
1011 default:
1012 break;
1013 }
1014
1015 Size += FS.hasPlusPrefix() || FS.hasSpacePrefix();
1016
1017 if (FS.hasAlternativeForm()) {
1018 switch (FS.getConversionSpecifier().getKind()) {
1019 // For o conversion, it increases the precision, if and only if necessary,
1020 // to force the first digit of the result to be a zero
1021 // (if the value and precision are both 0, a single 0 is printed)
1022 case analyze_format_string::ConversionSpecifier::oArg:
1023 // For b conversion, a nonzero result has 0b prefixed to it.
1024 case analyze_format_string::ConversionSpecifier::bArg:
1025 // For x (or X) conversion, a nonzero result has 0x (or 0X) prefixed to
1026 // it.
1027 case analyze_format_string::ConversionSpecifier::xArg:
1028 case analyze_format_string::ConversionSpecifier::XArg:
1029 // Note: even when the prefix is added, if
1030 // (prefix_width <= FieldWidth - formatted_length) holds,
1031 // the prefix does not increase the format
1032 // size. e.g.(("%#3x", 0xf) is "0xf")
1033
1034 // If the result is zero, o, b, x, X adds nothing.
1035 break;
1036 // For a, A, e, E, f, F, g, and G conversions,
1037 // the result of converting a floating-point number always contains a
1038 // decimal-point
1039 case analyze_format_string::ConversionSpecifier::aArg:
1040 case analyze_format_string::ConversionSpecifier::AArg:
1041 case analyze_format_string::ConversionSpecifier::eArg:
1042 case analyze_format_string::ConversionSpecifier::EArg:
1043 case analyze_format_string::ConversionSpecifier::fArg:
1044 case analyze_format_string::ConversionSpecifier::FArg:
1045 case analyze_format_string::ConversionSpecifier::gArg:
1046 case analyze_format_string::ConversionSpecifier::GArg:
1047 Size += (Precision ? 0 : 1);
1048 break;
1049 // For other conversions, the behavior is undefined.
1050 default:
1051 break;
1052 }
1053 }
1054 assert(SpecifierLen <= Size && "no underflow");
1055 Size -= SpecifierLen;
1056 return true;
1057 }
1058
1059 size_t getSizeLowerBound() const { return Size; }
1060 bool isKernelCompatible() const { return IsKernelCompatible; }
1061
1062private:
1063 static size_t computeFieldWidth(const analyze_printf::PrintfSpecifier &FS) {
1064 const analyze_format_string::OptionalAmount &FW = FS.getFieldWidth();
1065 size_t FieldWidth = 0;
1066 if (FW.getHowSpecified() == analyze_format_string::OptionalAmount::Constant)
1067 FieldWidth = FW.getConstantAmount();
1068 return FieldWidth;
1069 }
1070
1071 static size_t computePrecision(const analyze_printf::PrintfSpecifier &FS) {
1072 const analyze_format_string::OptionalAmount &FW = FS.getPrecision();
1073 size_t Precision = 0;
1074
1075 // See man 3 printf for default precision value based on the specifier.
1076 switch (FW.getHowSpecified()) {
1077 case analyze_format_string::OptionalAmount::NotSpecified:
1078 switch (FS.getConversionSpecifier().getKind()) {
1079 default:
1080 break;
1081 case analyze_format_string::ConversionSpecifier::dArg: // %d
1082 case analyze_format_string::ConversionSpecifier::DArg: // %D
1083 case analyze_format_string::ConversionSpecifier::iArg: // %i
1084 Precision = 1;
1085 break;
1086 case analyze_format_string::ConversionSpecifier::oArg: // %d
1087 case analyze_format_string::ConversionSpecifier::OArg: // %D
1088 case analyze_format_string::ConversionSpecifier::uArg: // %d
1089 case analyze_format_string::ConversionSpecifier::UArg: // %D
1090 case analyze_format_string::ConversionSpecifier::xArg: // %d
1091 case analyze_format_string::ConversionSpecifier::XArg: // %D
1092 Precision = 1;
1093 break;
1094 case analyze_format_string::ConversionSpecifier::fArg: // %f
1095 case analyze_format_string::ConversionSpecifier::FArg: // %F
1096 case analyze_format_string::ConversionSpecifier::eArg: // %e
1097 case analyze_format_string::ConversionSpecifier::EArg: // %E
1098 case analyze_format_string::ConversionSpecifier::gArg: // %g
1099 case analyze_format_string::ConversionSpecifier::GArg: // %G
1100 Precision = 6;
1101 break;
1102 case analyze_format_string::ConversionSpecifier::pArg: // %d
1103 Precision = 1;
1104 break;
1105 }
1106 break;
1107 case analyze_format_string::OptionalAmount::Constant:
1108 Precision = FW.getConstantAmount();
1109 break;
1110 default:
1111 break;
1112 }
1113 return Precision;
1114 }
1115};
1116
1117} // namespace
1118
1119static bool ProcessFormatStringLiteral(const Expr *FormatExpr,
1120 StringRef &FormatStrRef, size_t &StrLen,
1121 ASTContext &Context) {
1122 if (const auto *Format = dyn_cast<StringLiteral>(Val: FormatExpr);
1123 Format && (Format->isOrdinary() || Format->isUTF8())) {
1124 FormatStrRef = Format->getString();
1125 const ConstantArrayType *T =
1126 Context.getAsConstantArrayType(T: Format->getType());
1127 assert(T && "String literal not of constant array type!");
1128 size_t TypeSize = T->getZExtSize();
1129 // In case there's a null byte somewhere.
1130 StrLen = std::min(a: std::max(a: TypeSize, b: size_t(1)) - 1, b: FormatStrRef.find(C: 0));
1131 return true;
1132 }
1133 return false;
1134}
1135
1136void Sema::checkFortifiedBuiltinMemoryFunction(FunctionDecl *FD,
1137 CallExpr *TheCall) {
1138 if (TheCall->isValueDependent() || TheCall->isTypeDependent() ||
1139 isConstantEvaluatedContext())
1140 return;
1141
1142 bool UseDABAttr = false;
1143 const FunctionDecl *UseDecl = FD;
1144
1145 const auto *DABAttr = FD->getAttr<DiagnoseAsBuiltinAttr>();
1146 if (DABAttr) {
1147 UseDecl = DABAttr->getFunction();
1148 assert(UseDecl && "Missing FunctionDecl in DiagnoseAsBuiltin attribute!");
1149 UseDABAttr = true;
1150 }
1151
1152 unsigned BuiltinID = UseDecl->getBuiltinID(/*ConsiderWrappers=*/ConsiderWrapperFunctions: true);
1153
1154 if (!BuiltinID)
1155 return;
1156
1157 const TargetInfo &TI = getASTContext().getTargetInfo();
1158 unsigned SizeTypeWidth = TI.getTypeWidth(T: TI.getSizeType());
1159
1160 auto TranslateIndex = [&](unsigned Index) -> std::optional<unsigned> {
1161 // If we refer to a diagnose_as_builtin attribute, we need to change the
1162 // argument index to refer to the arguments of the called function. Unless
1163 // the index is out of bounds, which presumably means it's a variadic
1164 // function.
1165 if (!UseDABAttr)
1166 return Index;
1167 unsigned DABIndices = DABAttr->argIndices_size();
1168 unsigned NewIndex = Index < DABIndices
1169 ? DABAttr->argIndices_begin()[Index]
1170 : Index - DABIndices + FD->getNumParams();
1171 if (NewIndex >= TheCall->getNumArgs())
1172 return std::nullopt;
1173 return NewIndex;
1174 };
1175
1176 auto ComputeExplicitObjectSizeArgument =
1177 [&](unsigned Index) -> std::optional<llvm::APSInt> {
1178 std::optional<unsigned> IndexOptional = TranslateIndex(Index);
1179 if (!IndexOptional)
1180 return std::nullopt;
1181 unsigned NewIndex = *IndexOptional;
1182 Expr::EvalResult Result;
1183 Expr *SizeArg = TheCall->getArg(Arg: NewIndex);
1184 if (!SizeArg->EvaluateAsInt(Result, Ctx: getASTContext()))
1185 return std::nullopt;
1186 llvm::APSInt Integer = Result.Val.getInt();
1187 Integer.setIsUnsigned(true);
1188 return Integer;
1189 };
1190
1191 auto ComputeSizeArgument =
1192 [&](unsigned Index) -> std::optional<llvm::APSInt> {
1193 // If the parameter has a pass_object_size attribute, then we should use its
1194 // (potentially) more strict checking mode. Otherwise, conservatively assume
1195 // type 0.
1196 int BOSType = 0;
1197 // This check can fail for variadic functions.
1198 if (Index < FD->getNumParams()) {
1199 if (const auto *POS =
1200 FD->getParamDecl(Index)->getAttr<PassObjectSizeAttr>())
1201 BOSType = POS->getType();
1202 }
1203
1204 std::optional<unsigned> IndexOptional = TranslateIndex(Index);
1205 if (!IndexOptional)
1206 return std::nullopt;
1207 unsigned NewIndex = *IndexOptional;
1208
1209 if (NewIndex >= TheCall->getNumArgs())
1210 return std::nullopt;
1211
1212 const Expr *ObjArg = TheCall->getArg(Arg: NewIndex);
1213 uint64_t Result;
1214 if (!ObjArg->tryEvaluateObjectSize(Result, Ctx&: getASTContext(), Type: BOSType))
1215 return std::nullopt;
1216
1217 // Get the object size in the target's size_t width.
1218 return llvm::APSInt::getUnsigned(X: Result).extOrTrunc(width: SizeTypeWidth);
1219 };
1220
1221 auto ComputeStrLenArgument =
1222 [&](unsigned Index) -> std::optional<llvm::APSInt> {
1223 std::optional<unsigned> IndexOptional = TranslateIndex(Index);
1224 if (!IndexOptional)
1225 return std::nullopt;
1226 unsigned NewIndex = *IndexOptional;
1227
1228 const Expr *ObjArg = TheCall->getArg(Arg: NewIndex);
1229 uint64_t Result;
1230 if (!ObjArg->tryEvaluateStrLen(Result, Ctx&: getASTContext()))
1231 return std::nullopt;
1232 // Add 1 for null byte.
1233 return llvm::APSInt::getUnsigned(X: Result + 1).extOrTrunc(width: SizeTypeWidth);
1234 };
1235
1236 std::optional<llvm::APSInt> SourceSize;
1237 std::optional<llvm::APSInt> DestinationSize;
1238 unsigned DiagID = 0;
1239 bool IsChkVariant = false;
1240
1241 auto GetFunctionName = [&]() {
1242 std::string FunctionNameStr =
1243 getASTContext().BuiltinInfo.getName(ID: BuiltinID);
1244 llvm::StringRef FunctionName = FunctionNameStr;
1245 // Skim off the details of whichever builtin was called to produce a better
1246 // diagnostic, as it's unlikely that the user wrote the __builtin
1247 // explicitly.
1248 if (IsChkVariant) {
1249 FunctionName = FunctionName.drop_front(N: std::strlen(s: "__builtin___"));
1250 FunctionName = FunctionName.drop_back(N: std::strlen(s: "_chk"));
1251 } else {
1252 FunctionName.consume_front(Prefix: "__builtin_");
1253 }
1254 return FunctionName.str();
1255 };
1256
1257 switch (BuiltinID) {
1258 default:
1259 return;
1260 case Builtin::BI__builtin_stpcpy:
1261 case Builtin::BIstpcpy:
1262 case Builtin::BI__builtin_strcpy:
1263 case Builtin::BIstrcpy: {
1264 DiagID = diag::warn_fortify_strlen_overflow;
1265 SourceSize = ComputeStrLenArgument(1);
1266 DestinationSize = ComputeSizeArgument(0);
1267 break;
1268 }
1269
1270 case Builtin::BI__builtin___stpcpy_chk:
1271 case Builtin::BI__builtin___strcpy_chk: {
1272 DiagID = diag::warn_fortify_strlen_overflow;
1273 SourceSize = ComputeStrLenArgument(1);
1274 DestinationSize = ComputeExplicitObjectSizeArgument(2);
1275 IsChkVariant = true;
1276 break;
1277 }
1278
1279 case Builtin::BIscanf:
1280 case Builtin::BIfscanf:
1281 case Builtin::BIsscanf: {
1282 unsigned FormatIndex = 1;
1283 unsigned DataIndex = 2;
1284 if (BuiltinID == Builtin::BIscanf) {
1285 FormatIndex = 0;
1286 DataIndex = 1;
1287 }
1288
1289 const auto *FormatExpr =
1290 TheCall->getArg(Arg: FormatIndex)->IgnoreParenImpCasts();
1291
1292 StringRef FormatStrRef;
1293 size_t StrLen;
1294 if (!ProcessFormatStringLiteral(FormatExpr, FormatStrRef, StrLen, Context))
1295 return;
1296
1297 auto Diagnose = [&](unsigned ArgIndex, unsigned DestSize,
1298 unsigned SourceSize) {
1299 DiagID = diag::warn_fortify_scanf_overflow;
1300 unsigned Index = ArgIndex + DataIndex;
1301 std::string FunctionName = GetFunctionName();
1302 DiagRuntimeBehavior(TheCall->getArg(Arg: Index)->getBeginLoc(), TheCall,
1303 PDiag(DiagID) << FunctionName << (Index + 1)
1304 << DestSize << SourceSize);
1305 };
1306
1307 auto ShiftedComputeSizeArgument = [&](unsigned Index) {
1308 return ComputeSizeArgument(Index + DataIndex);
1309 };
1310 ScanfDiagnosticFormatHandler H(ShiftedComputeSizeArgument, Diagnose);
1311 const char *FormatBytes = FormatStrRef.data();
1312 analyze_format_string::ParseScanfString(H, beg: FormatBytes,
1313 end: FormatBytes + StrLen, LO: getLangOpts(),
1314 Target: Context.getTargetInfo());
1315
1316 // Unlike the other cases, in this one we have already issued the diagnostic
1317 // here, so no need to continue (because unlike the other cases, here the
1318 // diagnostic refers to the argument number).
1319 return;
1320 }
1321
1322 case Builtin::BIsprintf:
1323 case Builtin::BI__builtin___sprintf_chk: {
1324 size_t FormatIndex = BuiltinID == Builtin::BIsprintf ? 1 : 3;
1325 auto *FormatExpr = TheCall->getArg(Arg: FormatIndex)->IgnoreParenImpCasts();
1326
1327 StringRef FormatStrRef;
1328 size_t StrLen;
1329 if (ProcessFormatStringLiteral(FormatExpr, FormatStrRef, StrLen, Context)) {
1330 EstimateSizeFormatHandler H(FormatStrRef);
1331 const char *FormatBytes = FormatStrRef.data();
1332 if (!analyze_format_string::ParsePrintfString(
1333 H, beg: FormatBytes, end: FormatBytes + StrLen, LO: getLangOpts(),
1334 Target: Context.getTargetInfo(), isFreeBSDKPrintf: false)) {
1335 DiagID = H.isKernelCompatible()
1336 ? diag::warn_format_overflow
1337 : diag::warn_format_overflow_non_kprintf;
1338 SourceSize = llvm::APSInt::getUnsigned(X: H.getSizeLowerBound())
1339 .extOrTrunc(width: SizeTypeWidth);
1340 if (BuiltinID == Builtin::BI__builtin___sprintf_chk) {
1341 DestinationSize = ComputeExplicitObjectSizeArgument(2);
1342 IsChkVariant = true;
1343 } else {
1344 DestinationSize = ComputeSizeArgument(0);
1345 }
1346 break;
1347 }
1348 }
1349 return;
1350 }
1351 case Builtin::BI__builtin___memcpy_chk:
1352 case Builtin::BI__builtin___memmove_chk:
1353 case Builtin::BI__builtin___memset_chk:
1354 case Builtin::BI__builtin___strlcat_chk:
1355 case Builtin::BI__builtin___strlcpy_chk:
1356 case Builtin::BI__builtin___strncat_chk:
1357 case Builtin::BI__builtin___strncpy_chk:
1358 case Builtin::BI__builtin___stpncpy_chk:
1359 case Builtin::BI__builtin___memccpy_chk:
1360 case Builtin::BI__builtin___mempcpy_chk: {
1361 DiagID = diag::warn_builtin_chk_overflow;
1362 SourceSize = ComputeExplicitObjectSizeArgument(TheCall->getNumArgs() - 2);
1363 DestinationSize =
1364 ComputeExplicitObjectSizeArgument(TheCall->getNumArgs() - 1);
1365 IsChkVariant = true;
1366 break;
1367 }
1368
1369 case Builtin::BI__builtin___snprintf_chk:
1370 case Builtin::BI__builtin___vsnprintf_chk: {
1371 DiagID = diag::warn_builtin_chk_overflow;
1372 SourceSize = ComputeExplicitObjectSizeArgument(1);
1373 DestinationSize = ComputeExplicitObjectSizeArgument(3);
1374 IsChkVariant = true;
1375 break;
1376 }
1377
1378 case Builtin::BIstrncat:
1379 case Builtin::BI__builtin_strncat:
1380 case Builtin::BIstrncpy:
1381 case Builtin::BI__builtin_strncpy:
1382 case Builtin::BIstpncpy:
1383 case Builtin::BI__builtin_stpncpy: {
1384 // Whether these functions overflow depends on the runtime strlen of the
1385 // string, not just the buffer size, so emitting the "always overflow"
1386 // diagnostic isn't quite right. We should still diagnose passing a buffer
1387 // size larger than the destination buffer though; this is a runtime abort
1388 // in _FORTIFY_SOURCE mode, and is quite suspicious otherwise.
1389 DiagID = diag::warn_fortify_source_size_mismatch;
1390 SourceSize = ComputeExplicitObjectSizeArgument(TheCall->getNumArgs() - 1);
1391 DestinationSize = ComputeSizeArgument(0);
1392 break;
1393 }
1394
1395 case Builtin::BImemcpy:
1396 case Builtin::BI__builtin_memcpy:
1397 case Builtin::BImemmove:
1398 case Builtin::BI__builtin_memmove:
1399 case Builtin::BImemset:
1400 case Builtin::BI__builtin_memset:
1401 case Builtin::BImempcpy:
1402 case Builtin::BI__builtin_mempcpy: {
1403 DiagID = diag::warn_fortify_source_overflow;
1404 SourceSize = ComputeExplicitObjectSizeArgument(TheCall->getNumArgs() - 1);
1405 DestinationSize = ComputeSizeArgument(0);
1406 break;
1407 }
1408 case Builtin::BIsnprintf:
1409 case Builtin::BI__builtin_snprintf:
1410 case Builtin::BIvsnprintf:
1411 case Builtin::BI__builtin_vsnprintf: {
1412 DiagID = diag::warn_fortify_source_size_mismatch;
1413 SourceSize = ComputeExplicitObjectSizeArgument(1);
1414 const auto *FormatExpr = TheCall->getArg(Arg: 2)->IgnoreParenImpCasts();
1415 StringRef FormatStrRef;
1416 size_t StrLen;
1417 if (SourceSize &&
1418 ProcessFormatStringLiteral(FormatExpr, FormatStrRef, StrLen, Context)) {
1419 EstimateSizeFormatHandler H(FormatStrRef);
1420 const char *FormatBytes = FormatStrRef.data();
1421 if (!analyze_format_string::ParsePrintfString(
1422 H, beg: FormatBytes, end: FormatBytes + StrLen, LO: getLangOpts(),
1423 Target: Context.getTargetInfo(), /*isFreeBSDKPrintf=*/false)) {
1424 llvm::APSInt FormatSize =
1425 llvm::APSInt::getUnsigned(X: H.getSizeLowerBound())
1426 .extOrTrunc(width: SizeTypeWidth);
1427 if (FormatSize > *SourceSize && *SourceSize != 0) {
1428 unsigned TruncationDiagID =
1429 H.isKernelCompatible() ? diag::warn_format_truncation
1430 : diag::warn_format_truncation_non_kprintf;
1431 SmallString<16> SpecifiedSizeStr;
1432 SmallString<16> FormatSizeStr;
1433 SourceSize->toString(Str&: SpecifiedSizeStr, /*Radix=*/10);
1434 FormatSize.toString(Str&: FormatSizeStr, /*Radix=*/10);
1435 DiagRuntimeBehavior(TheCall->getBeginLoc(), TheCall,
1436 PDiag(TruncationDiagID)
1437 << GetFunctionName() << SpecifiedSizeStr
1438 << FormatSizeStr);
1439 }
1440 }
1441 }
1442 DestinationSize = ComputeSizeArgument(0);
1443 }
1444 }
1445
1446 if (!SourceSize || !DestinationSize ||
1447 llvm::APSInt::compareValues(I1: *SourceSize, I2: *DestinationSize) <= 0)
1448 return;
1449
1450 std::string FunctionName = GetFunctionName();
1451
1452 SmallString<16> DestinationStr;
1453 SmallString<16> SourceStr;
1454 DestinationSize->toString(Str&: DestinationStr, /*Radix=*/10);
1455 SourceSize->toString(Str&: SourceStr, /*Radix=*/10);
1456 DiagRuntimeBehavior(TheCall->getBeginLoc(), TheCall,
1457 PDiag(DiagID)
1458 << FunctionName << DestinationStr << SourceStr);
1459}
1460
1461static bool BuiltinSEHScopeCheck(Sema &SemaRef, CallExpr *TheCall,
1462 Scope::ScopeFlags NeededScopeFlags,
1463 unsigned DiagID) {
1464 // Scopes aren't available during instantiation. Fortunately, builtin
1465 // functions cannot be template args so they cannot be formed through template
1466 // instantiation. Therefore checking once during the parse is sufficient.
1467 if (SemaRef.inTemplateInstantiation())
1468 return false;
1469
1470 Scope *S = SemaRef.getCurScope();
1471 while (S && !S->isSEHExceptScope())
1472 S = S->getParent();
1473 if (!S || !(S->getFlags() & NeededScopeFlags)) {
1474 auto *DRE = cast<DeclRefExpr>(Val: TheCall->getCallee()->IgnoreParenCasts());
1475 SemaRef.Diag(TheCall->getExprLoc(), DiagID)
1476 << DRE->getDecl()->getIdentifier();
1477 return true;
1478 }
1479
1480 return false;
1481}
1482
1483// In OpenCL, __builtin_alloca_* should return a pointer to address space
1484// that corresponds to the stack address space i.e private address space.
1485static void builtinAllocaAddrSpace(Sema &S, CallExpr *TheCall) {
1486 QualType RT = TheCall->getType();
1487 assert((RT->isPointerType() && !(RT->getPointeeType().hasAddressSpace())) &&
1488 "__builtin_alloca has invalid address space");
1489
1490 RT = RT->getPointeeType();
1491 RT = S.Context.getAddrSpaceQualType(T: RT, AddressSpace: LangAS::opencl_private);
1492 TheCall->setType(S.Context.getPointerType(T: RT));
1493}
1494
1495namespace {
1496enum PointerAuthOpKind {
1497 PAO_Strip,
1498 PAO_Sign,
1499 PAO_Auth,
1500 PAO_SignGeneric,
1501 PAO_Discriminator,
1502 PAO_BlendPointer,
1503 PAO_BlendInteger
1504};
1505}
1506
1507bool Sema::checkPointerAuthEnabled(SourceLocation Loc, SourceRange Range) {
1508 if (getLangOpts().PointerAuthIntrinsics)
1509 return false;
1510
1511 Diag(Loc, diag::err_ptrauth_disabled) << Range;
1512 return true;
1513}
1514
1515static bool checkPointerAuthEnabled(Sema &S, Expr *E) {
1516 return S.checkPointerAuthEnabled(Loc: E->getExprLoc(), Range: E->getSourceRange());
1517}
1518
1519static bool checkPointerAuthKey(Sema &S, Expr *&Arg) {
1520 // Convert it to type 'int'.
1521 if (convertArgumentToType(S, Arg, S.Context.IntTy))
1522 return true;
1523
1524 // Value-dependent expressions are okay; wait for template instantiation.
1525 if (Arg->isValueDependent())
1526 return false;
1527
1528 unsigned KeyValue;
1529 return S.checkConstantPointerAuthKey(keyExpr: Arg, key&: KeyValue);
1530}
1531
1532bool Sema::checkConstantPointerAuthKey(Expr *Arg, unsigned &Result) {
1533 // Attempt to constant-evaluate the expression.
1534 std::optional<llvm::APSInt> KeyValue = Arg->getIntegerConstantExpr(Ctx: Context);
1535 if (!KeyValue) {
1536 Diag(Arg->getExprLoc(), diag::err_expr_not_ice)
1537 << 0 << Arg->getSourceRange();
1538 return true;
1539 }
1540
1541 // Ask the target to validate the key parameter.
1542 if (!Context.getTargetInfo().validatePointerAuthKey(value: *KeyValue)) {
1543 llvm::SmallString<32> Value;
1544 {
1545 llvm::raw_svector_ostream Str(Value);
1546 Str << *KeyValue;
1547 }
1548
1549 Diag(Arg->getExprLoc(), diag::err_ptrauth_invalid_key)
1550 << Value << Arg->getSourceRange();
1551 return true;
1552 }
1553
1554 Result = KeyValue->getZExtValue();
1555 return false;
1556}
1557
1558bool Sema::checkPointerAuthDiscriminatorArg(Expr *Arg,
1559 PointerAuthDiscArgKind Kind,
1560 unsigned &IntVal) {
1561 if (!Arg) {
1562 IntVal = 0;
1563 return true;
1564 }
1565
1566 std::optional<llvm::APSInt> Result = Arg->getIntegerConstantExpr(Ctx: Context);
1567 if (!Result) {
1568 Diag(Arg->getExprLoc(), diag::err_ptrauth_arg_not_ice);
1569 return false;
1570 }
1571
1572 unsigned Max;
1573 bool IsAddrDiscArg = false;
1574
1575 switch (Kind) {
1576 case PointerAuthDiscArgKind::Addr:
1577 Max = 1;
1578 IsAddrDiscArg = true;
1579 break;
1580 case PointerAuthDiscArgKind::Extra:
1581 Max = PointerAuthQualifier::MaxDiscriminator;
1582 break;
1583 };
1584
1585 if (*Result < 0 || *Result > Max) {
1586 if (IsAddrDiscArg)
1587 Diag(Arg->getExprLoc(), diag::err_ptrauth_address_discrimination_invalid)
1588 << Result->getExtValue();
1589 else
1590 Diag(Arg->getExprLoc(), diag::err_ptrauth_extra_discriminator_invalid)
1591 << Result->getExtValue() << Max;
1592
1593 return false;
1594 };
1595
1596 IntVal = Result->getZExtValue();
1597 return true;
1598}
1599
1600static std::pair<const ValueDecl *, CharUnits>
1601findConstantBaseAndOffset(Sema &S, Expr *E) {
1602 // Must evaluate as a pointer.
1603 Expr::EvalResult Result;
1604 if (!E->EvaluateAsRValue(Result, Ctx: S.Context) || !Result.Val.isLValue())
1605 return {nullptr, CharUnits()};
1606
1607 const auto *BaseDecl =
1608 Result.Val.getLValueBase().dyn_cast<const ValueDecl *>();
1609 if (!BaseDecl)
1610 return {nullptr, CharUnits()};
1611
1612 return {BaseDecl, Result.Val.getLValueOffset()};
1613}
1614
1615static bool checkPointerAuthValue(Sema &S, Expr *&Arg, PointerAuthOpKind OpKind,
1616 bool RequireConstant = false) {
1617 if (Arg->hasPlaceholderType()) {
1618 ExprResult R = S.CheckPlaceholderExpr(E: Arg);
1619 if (R.isInvalid())
1620 return true;
1621 Arg = R.get();
1622 }
1623
1624 auto AllowsPointer = [](PointerAuthOpKind OpKind) {
1625 return OpKind != PAO_BlendInteger;
1626 };
1627 auto AllowsInteger = [](PointerAuthOpKind OpKind) {
1628 return OpKind == PAO_Discriminator || OpKind == PAO_BlendInteger ||
1629 OpKind == PAO_SignGeneric;
1630 };
1631
1632 // Require the value to have the right range of type.
1633 QualType ExpectedTy;
1634 if (AllowsPointer(OpKind) && Arg->getType()->isPointerType()) {
1635 ExpectedTy = Arg->getType().getUnqualifiedType();
1636 } else if (AllowsPointer(OpKind) && Arg->getType()->isNullPtrType()) {
1637 ExpectedTy = S.Context.VoidPtrTy;
1638 } else if (AllowsInteger(OpKind) &&
1639 Arg->getType()->isIntegralOrUnscopedEnumerationType()) {
1640 ExpectedTy = S.Context.getUIntPtrType();
1641
1642 } else {
1643 // Diagnose the failures.
1644 S.Diag(Arg->getExprLoc(), diag::err_ptrauth_value_bad_type)
1645 << unsigned(OpKind == PAO_Discriminator ? 1
1646 : OpKind == PAO_BlendPointer ? 2
1647 : OpKind == PAO_BlendInteger ? 3
1648 : 0)
1649 << unsigned(AllowsInteger(OpKind) ? (AllowsPointer(OpKind) ? 2 : 1) : 0)
1650 << Arg->getType() << Arg->getSourceRange();
1651 return true;
1652 }
1653
1654 // Convert to that type. This should just be an lvalue-to-rvalue
1655 // conversion.
1656 if (convertArgumentToType(S, Value&: Arg, Ty: ExpectedTy))
1657 return true;
1658
1659 if (!RequireConstant) {
1660 // Warn about null pointers for non-generic sign and auth operations.
1661 if ((OpKind == PAO_Sign || OpKind == PAO_Auth) &&
1662 Arg->isNullPointerConstant(Ctx&: S.Context, NPC: Expr::NPC_ValueDependentIsNull)) {
1663 S.Diag(Arg->getExprLoc(), OpKind == PAO_Sign
1664 ? diag::warn_ptrauth_sign_null_pointer
1665 : diag::warn_ptrauth_auth_null_pointer)
1666 << Arg->getSourceRange();
1667 }
1668
1669 return false;
1670 }
1671
1672 // Perform special checking on the arguments to ptrauth_sign_constant.
1673
1674 // The main argument.
1675 if (OpKind == PAO_Sign) {
1676 // Require the value we're signing to have a special form.
1677 auto [BaseDecl, Offset] = findConstantBaseAndOffset(S, E: Arg);
1678 bool Invalid;
1679
1680 // Must be rooted in a declaration reference.
1681 if (!BaseDecl)
1682 Invalid = true;
1683
1684 // If it's a function declaration, we can't have an offset.
1685 else if (isa<FunctionDecl>(Val: BaseDecl))
1686 Invalid = !Offset.isZero();
1687
1688 // Otherwise we're fine.
1689 else
1690 Invalid = false;
1691
1692 if (Invalid)
1693 S.Diag(Arg->getExprLoc(), diag::err_ptrauth_bad_constant_pointer);
1694 return Invalid;
1695 }
1696
1697 // The discriminator argument.
1698 assert(OpKind == PAO_Discriminator);
1699
1700 // Must be a pointer or integer or blend thereof.
1701 Expr *Pointer = nullptr;
1702 Expr *Integer = nullptr;
1703 if (auto *Call = dyn_cast<CallExpr>(Val: Arg->IgnoreParens())) {
1704 if (Call->getBuiltinCallee() ==
1705 Builtin::BI__builtin_ptrauth_blend_discriminator) {
1706 Pointer = Call->getArg(Arg: 0);
1707 Integer = Call->getArg(Arg: 1);
1708 }
1709 }
1710 if (!Pointer && !Integer) {
1711 if (Arg->getType()->isPointerType())
1712 Pointer = Arg;
1713 else
1714 Integer = Arg;
1715 }
1716
1717 // Check the pointer.
1718 bool Invalid = false;
1719 if (Pointer) {
1720 assert(Pointer->getType()->isPointerType());
1721
1722 // TODO: if we're initializing a global, check that the address is
1723 // somehow related to what we're initializing. This probably will
1724 // never really be feasible and we'll have to catch it at link-time.
1725 auto [BaseDecl, Offset] = findConstantBaseAndOffset(S, E: Pointer);
1726 if (!BaseDecl || !isa<VarDecl>(Val: BaseDecl))
1727 Invalid = true;
1728 }
1729
1730 // Check the integer.
1731 if (Integer) {
1732 assert(Integer->getType()->isIntegerType());
1733 if (!Integer->isEvaluatable(Ctx: S.Context))
1734 Invalid = true;
1735 }
1736
1737 if (Invalid)
1738 S.Diag(Arg->getExprLoc(), diag::err_ptrauth_bad_constant_discriminator);
1739 return Invalid;
1740}
1741
1742static ExprResult PointerAuthStrip(Sema &S, CallExpr *Call) {
1743 if (S.checkArgCount(Call, DesiredArgCount: 2))
1744 return ExprError();
1745 if (checkPointerAuthEnabled(S, Call))
1746 return ExprError();
1747 if (checkPointerAuthValue(S, Arg&: Call->getArgs()[0], OpKind: PAO_Strip) ||
1748 checkPointerAuthKey(S, Arg&: Call->getArgs()[1]))
1749 return ExprError();
1750
1751 Call->setType(Call->getArgs()[0]->getType());
1752 return Call;
1753}
1754
1755static ExprResult PointerAuthBlendDiscriminator(Sema &S, CallExpr *Call) {
1756 if (S.checkArgCount(Call, DesiredArgCount: 2))
1757 return ExprError();
1758 if (checkPointerAuthEnabled(S, Call))
1759 return ExprError();
1760 if (checkPointerAuthValue(S, Arg&: Call->getArgs()[0], OpKind: PAO_BlendPointer) ||
1761 checkPointerAuthValue(S, Arg&: Call->getArgs()[1], OpKind: PAO_BlendInteger))
1762 return ExprError();
1763
1764 Call->setType(S.Context.getUIntPtrType());
1765 return Call;
1766}
1767
1768static ExprResult PointerAuthSignGenericData(Sema &S, CallExpr *Call) {
1769 if (S.checkArgCount(Call, DesiredArgCount: 2))
1770 return ExprError();
1771 if (checkPointerAuthEnabled(S, Call))
1772 return ExprError();
1773 if (checkPointerAuthValue(S, Arg&: Call->getArgs()[0], OpKind: PAO_SignGeneric) ||
1774 checkPointerAuthValue(S, Arg&: Call->getArgs()[1], OpKind: PAO_Discriminator))
1775 return ExprError();
1776
1777 Call->setType(S.Context.getUIntPtrType());
1778 return Call;
1779}
1780
1781static ExprResult PointerAuthSignOrAuth(Sema &S, CallExpr *Call,
1782 PointerAuthOpKind OpKind,
1783 bool RequireConstant) {
1784 if (S.checkArgCount(Call, DesiredArgCount: 3))
1785 return ExprError();
1786 if (checkPointerAuthEnabled(S, Call))
1787 return ExprError();
1788 if (checkPointerAuthValue(S, Arg&: Call->getArgs()[0], OpKind, RequireConstant) ||
1789 checkPointerAuthKey(S, Arg&: Call->getArgs()[1]) ||
1790 checkPointerAuthValue(S, Arg&: Call->getArgs()[2], OpKind: PAO_Discriminator,
1791 RequireConstant))
1792 return ExprError();
1793
1794 Call->setType(Call->getArgs()[0]->getType());
1795 return Call;
1796}
1797
1798static ExprResult PointerAuthAuthAndResign(Sema &S, CallExpr *Call) {
1799 if (S.checkArgCount(Call, DesiredArgCount: 5))
1800 return ExprError();
1801 if (checkPointerAuthEnabled(S, Call))
1802 return ExprError();
1803 if (checkPointerAuthValue(S, Arg&: Call->getArgs()[0], OpKind: PAO_Auth) ||
1804 checkPointerAuthKey(S, Arg&: Call->getArgs()[1]) ||
1805 checkPointerAuthValue(S, Arg&: Call->getArgs()[2], OpKind: PAO_Discriminator) ||
1806 checkPointerAuthKey(S, Arg&: Call->getArgs()[3]) ||
1807 checkPointerAuthValue(S, Arg&: Call->getArgs()[4], OpKind: PAO_Discriminator))
1808 return ExprError();
1809
1810 Call->setType(Call->getArgs()[0]->getType());
1811 return Call;
1812}
1813
1814static ExprResult PointerAuthStringDiscriminator(Sema &S, CallExpr *Call) {
1815 if (checkPointerAuthEnabled(S, Call))
1816 return ExprError();
1817
1818 // We've already performed normal call type-checking.
1819 const Expr *Arg = Call->getArg(Arg: 0)->IgnoreParenImpCasts();
1820
1821 // Operand must be an ordinary or UTF-8 string literal.
1822 const auto *Literal = dyn_cast<StringLiteral>(Val: Arg);
1823 if (!Literal || Literal->getCharByteWidth() != 1) {
1824 S.Diag(Arg->getExprLoc(), diag::err_ptrauth_string_not_literal)
1825 << (Literal ? 1 : 0) << Arg->getSourceRange();
1826 return ExprError();
1827 }
1828
1829 return Call;
1830}
1831
1832static ExprResult GetVTablePointer(Sema &S, CallExpr *Call) {
1833 if (S.checkArgCount(Call, DesiredArgCount: 1))
1834 return ExprError();
1835 Expr *FirstArg = Call->getArg(Arg: 0);
1836 ExprResult FirstValue = S.DefaultFunctionArrayLvalueConversion(E: FirstArg);
1837 if (FirstValue.isInvalid())
1838 return ExprError();
1839 Call->setArg(Arg: 0, ArgExpr: FirstValue.get());
1840 QualType FirstArgType = FirstArg->getType();
1841 if (FirstArgType->canDecayToPointerType() && FirstArgType->isArrayType())
1842 FirstArgType = S.Context.getDecayedType(T: FirstArgType);
1843
1844 const CXXRecordDecl *FirstArgRecord = FirstArgType->getPointeeCXXRecordDecl();
1845 if (!FirstArgRecord) {
1846 S.Diag(FirstArg->getBeginLoc(), diag::err_get_vtable_pointer_incorrect_type)
1847 << /*isPolymorphic=*/0 << FirstArgType;
1848 return ExprError();
1849 }
1850 if (S.RequireCompleteType(
1851 FirstArg->getBeginLoc(), FirstArgType->getPointeeType(),
1852 diag::err_get_vtable_pointer_requires_complete_type)) {
1853 return ExprError();
1854 }
1855
1856 if (!FirstArgRecord->isPolymorphic()) {
1857 S.Diag(FirstArg->getBeginLoc(), diag::err_get_vtable_pointer_incorrect_type)
1858 << /*isPolymorphic=*/1 << FirstArgRecord;
1859 return ExprError();
1860 }
1861 QualType ReturnType = S.Context.getPointerType(S.Context.VoidTy.withConst());
1862 Call->setType(ReturnType);
1863 return Call;
1864}
1865
1866static ExprResult BuiltinLaunder(Sema &S, CallExpr *TheCall) {
1867 if (S.checkArgCount(Call: TheCall, DesiredArgCount: 1))
1868 return ExprError();
1869
1870 // Compute __builtin_launder's parameter type from the argument.
1871 // The parameter type is:
1872 // * The type of the argument if it's not an array or function type,
1873 // Otherwise,
1874 // * The decayed argument type.
1875 QualType ParamTy = [&]() {
1876 QualType ArgTy = TheCall->getArg(Arg: 0)->getType();
1877 if (const ArrayType *Ty = ArgTy->getAsArrayTypeUnsafe())
1878 return S.Context.getPointerType(Ty->getElementType());
1879 if (ArgTy->isFunctionType()) {
1880 return S.Context.getPointerType(ArgTy);
1881 }
1882 return ArgTy;
1883 }();
1884
1885 TheCall->setType(ParamTy);
1886
1887 auto DiagSelect = [&]() -> std::optional<unsigned> {
1888 if (!ParamTy->isPointerType())
1889 return 0;
1890 if (ParamTy->isFunctionPointerType())
1891 return 1;
1892 if (ParamTy->isVoidPointerType())
1893 return 2;
1894 return std::optional<unsigned>{};
1895 }();
1896 if (DiagSelect) {
1897 S.Diag(TheCall->getBeginLoc(), diag::err_builtin_launder_invalid_arg)
1898 << *DiagSelect << TheCall->getSourceRange();
1899 return ExprError();
1900 }
1901
1902 // We either have an incomplete class type, or we have a class template
1903 // whose instantiation has not been forced. Example:
1904 //
1905 // template <class T> struct Foo { T value; };
1906 // Foo<int> *p = nullptr;
1907 // auto *d = __builtin_launder(p);
1908 if (S.RequireCompleteType(TheCall->getBeginLoc(), ParamTy->getPointeeType(),
1909 diag::err_incomplete_type))
1910 return ExprError();
1911
1912 assert(ParamTy->getPointeeType()->isObjectType() &&
1913 "Unhandled non-object pointer case");
1914
1915 InitializedEntity Entity =
1916 InitializedEntity::InitializeParameter(Context&: S.Context, Type: ParamTy, Consumed: false);
1917 ExprResult Arg =
1918 S.PerformCopyInitialization(Entity, EqualLoc: SourceLocation(), Init: TheCall->getArg(Arg: 0));
1919 if (Arg.isInvalid())
1920 return ExprError();
1921 TheCall->setArg(Arg: 0, ArgExpr: Arg.get());
1922
1923 return TheCall;
1924}
1925
1926static ExprResult BuiltinIsWithinLifetime(Sema &S, CallExpr *TheCall) {
1927 if (S.checkArgCount(Call: TheCall, DesiredArgCount: 1))
1928 return ExprError();
1929
1930 ExprResult Arg = S.DefaultFunctionArrayLvalueConversion(E: TheCall->getArg(Arg: 0));
1931 if (Arg.isInvalid())
1932 return ExprError();
1933 QualType ParamTy = Arg.get()->getType();
1934 TheCall->setArg(Arg: 0, ArgExpr: Arg.get());
1935 TheCall->setType(S.Context.BoolTy);
1936
1937 // Only accept pointers to objects as arguments, which should have object
1938 // pointer or void pointer types.
1939 if (const auto *PT = ParamTy->getAs<PointerType>()) {
1940 // LWG4138: Function pointer types not allowed
1941 if (PT->getPointeeType()->isFunctionType()) {
1942 S.Diag(TheCall->getArg(0)->getExprLoc(),
1943 diag::err_builtin_is_within_lifetime_invalid_arg)
1944 << 1;
1945 return ExprError();
1946 }
1947 // Disallow VLAs too since those shouldn't be able to
1948 // be a template parameter for `std::is_within_lifetime`
1949 if (PT->getPointeeType()->isVariableArrayType()) {
1950 S.Diag(TheCall->getArg(0)->getExprLoc(), diag::err_vla_unsupported)
1951 << 1 << "__builtin_is_within_lifetime";
1952 return ExprError();
1953 }
1954 } else {
1955 S.Diag(TheCall->getArg(0)->getExprLoc(),
1956 diag::err_builtin_is_within_lifetime_invalid_arg)
1957 << 0;
1958 return ExprError();
1959 }
1960 return TheCall;
1961}
1962
1963static ExprResult BuiltinTriviallyRelocate(Sema &S, CallExpr *TheCall) {
1964 if (S.checkArgCount(Call: TheCall, DesiredArgCount: 3))
1965 return ExprError();
1966
1967 QualType Dest = TheCall->getArg(Arg: 0)->getType();
1968 if (!Dest->isPointerType() || Dest.getCVRQualifiers() != 0) {
1969 S.Diag(TheCall->getArg(0)->getExprLoc(),
1970 diag::err_builtin_trivially_relocate_invalid_arg_type)
1971 << /*a pointer*/ 0;
1972 return ExprError();
1973 }
1974
1975 QualType T = Dest->getPointeeType();
1976 if (S.RequireCompleteType(TheCall->getBeginLoc(), T,
1977 diag::err_incomplete_type))
1978 return ExprError();
1979
1980 if (T.isConstQualified() || !S.IsCXXTriviallyRelocatableType(T) ||
1981 T->isIncompleteArrayType()) {
1982 S.Diag(TheCall->getArg(0)->getExprLoc(),
1983 diag::err_builtin_trivially_relocate_invalid_arg_type)
1984 << (T.isConstQualified() ? /*non-const*/ 1 : /*relocatable*/ 2);
1985 return ExprError();
1986 }
1987
1988 TheCall->setType(Dest);
1989
1990 QualType Src = TheCall->getArg(Arg: 1)->getType();
1991 if (Src.getCanonicalType() != Dest.getCanonicalType()) {
1992 S.Diag(TheCall->getArg(1)->getExprLoc(),
1993 diag::err_builtin_trivially_relocate_invalid_arg_type)
1994 << /*the same*/ 3;
1995 return ExprError();
1996 }
1997
1998 Expr *SizeExpr = TheCall->getArg(Arg: 2);
1999 ExprResult Size = S.DefaultLvalueConversion(E: SizeExpr);
2000 if (Size.isInvalid())
2001 return ExprError();
2002
2003 Size = S.tryConvertExprToType(E: Size.get(), Ty: S.getASTContext().getSizeType());
2004 if (Size.isInvalid())
2005 return ExprError();
2006 SizeExpr = Size.get();
2007 TheCall->setArg(Arg: 2, ArgExpr: SizeExpr);
2008
2009 return TheCall;
2010}
2011
2012// Emit an error and return true if the current object format type is in the
2013// list of unsupported types.
2014static bool CheckBuiltinTargetNotInUnsupported(
2015 Sema &S, unsigned BuiltinID, CallExpr *TheCall,
2016 ArrayRef<llvm::Triple::ObjectFormatType> UnsupportedObjectFormatTypes) {
2017 llvm::Triple::ObjectFormatType CurObjFormat =
2018 S.getASTContext().getTargetInfo().getTriple().getObjectFormat();
2019 if (llvm::is_contained(Range&: UnsupportedObjectFormatTypes, Element: CurObjFormat)) {
2020 S.Diag(TheCall->getBeginLoc(), diag::err_builtin_target_unsupported)
2021 << TheCall->getSourceRange();
2022 return true;
2023 }
2024 return false;
2025}
2026
2027// Emit an error and return true if the current architecture is not in the list
2028// of supported architectures.
2029static bool
2030CheckBuiltinTargetInSupported(Sema &S, CallExpr *TheCall,
2031 ArrayRef<llvm::Triple::ArchType> SupportedArchs) {
2032 llvm::Triple::ArchType CurArch =
2033 S.getASTContext().getTargetInfo().getTriple().getArch();
2034 if (llvm::is_contained(Range&: SupportedArchs, Element: CurArch))
2035 return false;
2036 S.Diag(TheCall->getBeginLoc(), diag::err_builtin_target_unsupported)
2037 << TheCall->getSourceRange();
2038 return true;
2039}
2040
2041static void CheckNonNullArgument(Sema &S, const Expr *ArgExpr,
2042 SourceLocation CallSiteLoc);
2043
2044bool Sema::CheckTSBuiltinFunctionCall(const TargetInfo &TI, unsigned BuiltinID,
2045 CallExpr *TheCall) {
2046 switch (TI.getTriple().getArch()) {
2047 default:
2048 // Some builtins don't require additional checking, so just consider these
2049 // acceptable.
2050 return false;
2051 case llvm::Triple::arm:
2052 case llvm::Triple::armeb:
2053 case llvm::Triple::thumb:
2054 case llvm::Triple::thumbeb:
2055 return ARM().CheckARMBuiltinFunctionCall(TI, BuiltinID, TheCall);
2056 case llvm::Triple::aarch64:
2057 case llvm::Triple::aarch64_32:
2058 case llvm::Triple::aarch64_be:
2059 return ARM().CheckAArch64BuiltinFunctionCall(TI, BuiltinID, TheCall);
2060 case llvm::Triple::bpfeb:
2061 case llvm::Triple::bpfel:
2062 return BPF().CheckBPFBuiltinFunctionCall(BuiltinID, TheCall);
2063 case llvm::Triple::dxil:
2064 return DirectX().CheckDirectXBuiltinFunctionCall(BuiltinID, TheCall);
2065 case llvm::Triple::hexagon:
2066 return Hexagon().CheckHexagonBuiltinFunctionCall(BuiltinID, TheCall);
2067 case llvm::Triple::mips:
2068 case llvm::Triple::mipsel:
2069 case llvm::Triple::mips64:
2070 case llvm::Triple::mips64el:
2071 return MIPS().CheckMipsBuiltinFunctionCall(TI, BuiltinID, TheCall);
2072 case llvm::Triple::spirv:
2073 case llvm::Triple::spirv32:
2074 case llvm::Triple::spirv64:
2075 if (TI.getTriple().getOS() != llvm::Triple::OSType::AMDHSA)
2076 return SPIRV().CheckSPIRVBuiltinFunctionCall(TI, BuiltinID, TheCall);
2077 return false;
2078 case llvm::Triple::systemz:
2079 return SystemZ().CheckSystemZBuiltinFunctionCall(BuiltinID, TheCall);
2080 case llvm::Triple::x86:
2081 case llvm::Triple::x86_64:
2082 return X86().CheckBuiltinFunctionCall(TI, BuiltinID, TheCall);
2083 case llvm::Triple::ppc:
2084 case llvm::Triple::ppcle:
2085 case llvm::Triple::ppc64:
2086 case llvm::Triple::ppc64le:
2087 return PPC().CheckPPCBuiltinFunctionCall(TI, BuiltinID, TheCall);
2088 case llvm::Triple::amdgcn:
2089 return AMDGPU().CheckAMDGCNBuiltinFunctionCall(BuiltinID, TheCall);
2090 case llvm::Triple::riscv32:
2091 case llvm::Triple::riscv64:
2092 return RISCV().CheckBuiltinFunctionCall(TI, BuiltinID, TheCall);
2093 case llvm::Triple::loongarch32:
2094 case llvm::Triple::loongarch64:
2095 return LoongArch().CheckLoongArchBuiltinFunctionCall(TI, BuiltinID,
2096 TheCall);
2097 case llvm::Triple::wasm32:
2098 case llvm::Triple::wasm64:
2099 return Wasm().CheckWebAssemblyBuiltinFunctionCall(TI, BuiltinID, TheCall);
2100 case llvm::Triple::nvptx:
2101 case llvm::Triple::nvptx64:
2102 return NVPTX().CheckNVPTXBuiltinFunctionCall(TI, BuiltinID, TheCall);
2103 }
2104}
2105
2106// Check if \p Ty is a valid type for the elementwise math builtins. If it is
2107// not a valid type, emit an error message and return true. Otherwise return
2108// false.
2109static bool
2110checkMathBuiltinElementType(Sema &S, SourceLocation Loc, QualType ArgTy,
2111 Sema::EltwiseBuiltinArgTyRestriction ArgTyRestr,
2112 int ArgOrdinal) {
2113 QualType EltTy = ArgTy;
2114 if (auto *VecTy = EltTy->getAs<VectorType>())
2115 EltTy = VecTy->getElementType();
2116
2117 switch (ArgTyRestr) {
2118 case Sema::EltwiseBuiltinArgTyRestriction::None:
2119 if (!ArgTy->getAs<VectorType>() &&
2120 !ConstantMatrixType::isValidElementType(T: ArgTy)) {
2121 return S.Diag(Loc, diag::err_builtin_invalid_arg_type)
2122 << ArgOrdinal << /* vector */ 2 << /* integer */ 1 << /* fp */ 1
2123 << ArgTy;
2124 }
2125 break;
2126 case Sema::EltwiseBuiltinArgTyRestriction::FloatTy:
2127 if (!EltTy->isRealFloatingType()) {
2128 return S.Diag(Loc, diag::err_builtin_invalid_arg_type)
2129 << ArgOrdinal << /* scalar or vector */ 5 << /* no int */ 0
2130 << /* floating-point */ 1 << ArgTy;
2131 }
2132 break;
2133 case Sema::EltwiseBuiltinArgTyRestriction::IntegerTy:
2134 if (!EltTy->isIntegerType()) {
2135 return S.Diag(Loc, diag::err_builtin_invalid_arg_type)
2136 << ArgOrdinal << /* scalar or vector */ 5 << /* integer */ 1
2137 << /* no fp */ 0 << ArgTy;
2138 }
2139 break;
2140 case Sema::EltwiseBuiltinArgTyRestriction::SignedIntOrFloatTy:
2141 if (EltTy->isUnsignedIntegerType()) {
2142 return S.Diag(Loc, diag::err_builtin_invalid_arg_type)
2143 << 1 << /* scalar or vector */ 5 << /* signed int */ 2
2144 << /* or fp */ 1 << ArgTy;
2145 }
2146 break;
2147 }
2148
2149 return false;
2150}
2151
2152/// BuiltinCpu{Supports|Is} - Handle __builtin_cpu_{supports|is}(char *).
2153/// This checks that the target supports the builtin and that the string
2154/// argument is constant and valid.
2155static bool BuiltinCpu(Sema &S, const TargetInfo &TI, CallExpr *TheCall,
2156 const TargetInfo *AuxTI, unsigned BuiltinID) {
2157 assert((BuiltinID == Builtin::BI__builtin_cpu_supports ||
2158 BuiltinID == Builtin::BI__builtin_cpu_is) &&
2159 "Expecting __builtin_cpu_...");
2160
2161 bool IsCPUSupports = BuiltinID == Builtin::BI__builtin_cpu_supports;
2162 const TargetInfo *TheTI = &TI;
2163 auto SupportsBI = [=](const TargetInfo *TInfo) {
2164 return TInfo && ((IsCPUSupports && TInfo->supportsCpuSupports()) ||
2165 (!IsCPUSupports && TInfo->supportsCpuIs()));
2166 };
2167 if (!SupportsBI(&TI) && SupportsBI(AuxTI))
2168 TheTI = AuxTI;
2169
2170 if ((!IsCPUSupports && !TheTI->supportsCpuIs()) ||
2171 (IsCPUSupports && !TheTI->supportsCpuSupports()))
2172 return S.Diag(TheCall->getBeginLoc(),
2173 TI.getTriple().isOSAIX()
2174 ? diag::err_builtin_aix_os_unsupported
2175 : diag::err_builtin_target_unsupported)
2176 << SourceRange(TheCall->getBeginLoc(), TheCall->getEndLoc());
2177
2178 Expr *Arg = TheCall->getArg(Arg: 0)->IgnoreParenImpCasts();
2179 // Check if the argument is a string literal.
2180 if (!isa<StringLiteral>(Arg))
2181 return S.Diag(TheCall->getBeginLoc(), diag::err_expr_not_string_literal)
2182 << Arg->getSourceRange();
2183
2184 // Check the contents of the string.
2185 StringRef Feature = cast<StringLiteral>(Val: Arg)->getString();
2186 if (IsCPUSupports && !TheTI->validateCpuSupports(Name: Feature)) {
2187 S.Diag(TheCall->getBeginLoc(), diag::warn_invalid_cpu_supports)
2188 << Arg->getSourceRange();
2189 return false;
2190 }
2191 if (!IsCPUSupports && !TheTI->validateCpuIs(Feature))
2192 return S.Diag(TheCall->getBeginLoc(), diag::err_invalid_cpu_is)
2193 << Arg->getSourceRange();
2194 return false;
2195}
2196
2197/// Checks that __builtin_popcountg was called with a single argument, which is
2198/// an unsigned integer.
2199static bool BuiltinPopcountg(Sema &S, CallExpr *TheCall) {
2200 if (S.checkArgCount(Call: TheCall, DesiredArgCount: 1))
2201 return true;
2202
2203 ExprResult ArgRes = S.DefaultLvalueConversion(E: TheCall->getArg(Arg: 0));
2204 if (ArgRes.isInvalid())
2205 return true;
2206
2207 Expr *Arg = ArgRes.get();
2208 TheCall->setArg(Arg: 0, ArgExpr: Arg);
2209
2210 QualType ArgTy = Arg->getType();
2211
2212 if (!ArgTy->isUnsignedIntegerType()) {
2213 S.Diag(Arg->getBeginLoc(), diag::err_builtin_invalid_arg_type)
2214 << 1 << /* scalar */ 1 << /* unsigned integer ty */ 3 << /* no fp */ 0
2215 << ArgTy;
2216 return true;
2217 }
2218 return false;
2219}
2220
2221/// Checks that __builtin_{clzg,ctzg} was called with a first argument, which is
2222/// an unsigned integer, and an optional second argument, which is promoted to
2223/// an 'int'.
2224static bool BuiltinCountZeroBitsGeneric(Sema &S, CallExpr *TheCall) {
2225 if (S.checkArgCountRange(Call: TheCall, MinArgCount: 1, MaxArgCount: 2))
2226 return true;
2227
2228 ExprResult Arg0Res = S.DefaultLvalueConversion(E: TheCall->getArg(Arg: 0));
2229 if (Arg0Res.isInvalid())
2230 return true;
2231
2232 Expr *Arg0 = Arg0Res.get();
2233 TheCall->setArg(Arg: 0, ArgExpr: Arg0);
2234
2235 QualType Arg0Ty = Arg0->getType();
2236
2237 if (!Arg0Ty->isUnsignedIntegerType()) {
2238 S.Diag(Arg0->getBeginLoc(), diag::err_builtin_invalid_arg_type)
2239 << 1 << /* scalar */ 1 << /* unsigned integer ty */ 3 << /* no fp */ 0
2240 << Arg0Ty;
2241 return true;
2242 }
2243
2244 if (TheCall->getNumArgs() > 1) {
2245 ExprResult Arg1Res = S.UsualUnaryConversions(E: TheCall->getArg(Arg: 1));
2246 if (Arg1Res.isInvalid())
2247 return true;
2248
2249 Expr *Arg1 = Arg1Res.get();
2250 TheCall->setArg(Arg: 1, ArgExpr: Arg1);
2251
2252 QualType Arg1Ty = Arg1->getType();
2253
2254 if (!Arg1Ty->isSpecificBuiltinType(K: BuiltinType::Int)) {
2255 S.Diag(Arg1->getBeginLoc(), diag::err_builtin_invalid_arg_type)
2256 << 2 << /* scalar */ 1 << /* 'int' ty */ 4 << /* no fp */ 0 << Arg1Ty;
2257 return true;
2258 }
2259 }
2260
2261 return false;
2262}
2263
2264ExprResult
2265Sema::CheckBuiltinFunctionCall(FunctionDecl *FDecl, unsigned BuiltinID,
2266 CallExpr *TheCall) {
2267 ExprResult TheCallResult(TheCall);
2268
2269 // Find out if any arguments are required to be integer constant expressions.
2270 unsigned ICEArguments = 0;
2271 ASTContext::GetBuiltinTypeError Error;
2272 Context.GetBuiltinType(ID: BuiltinID, Error, IntegerConstantArgs: &ICEArguments);
2273 if (Error != ASTContext::GE_None)
2274 ICEArguments = 0; // Don't diagnose previously diagnosed errors.
2275
2276 // If any arguments are required to be ICE's, check and diagnose.
2277 for (unsigned ArgNo = 0; ICEArguments != 0; ++ArgNo) {
2278 // Skip arguments not required to be ICE's.
2279 if ((ICEArguments & (1 << ArgNo)) == 0) continue;
2280
2281 llvm::APSInt Result;
2282 // If we don't have enough arguments, continue so we can issue better
2283 // diagnostic in checkArgCount(...)
2284 if (ArgNo < TheCall->getNumArgs() &&
2285 BuiltinConstantArg(TheCall, ArgNum: ArgNo, Result))
2286 return true;
2287 ICEArguments &= ~(1 << ArgNo);
2288 }
2289
2290 FPOptions FPO;
2291 switch (BuiltinID) {
2292 case Builtin::BI__builtin_cpu_supports:
2293 case Builtin::BI__builtin_cpu_is:
2294 if (BuiltinCpu(S&: *this, TI: Context.getTargetInfo(), TheCall,
2295 AuxTI: Context.getAuxTargetInfo(), BuiltinID))
2296 return ExprError();
2297 break;
2298 case Builtin::BI__builtin_cpu_init:
2299 if (!Context.getTargetInfo().supportsCpuInit()) {
2300 Diag(TheCall->getBeginLoc(), diag::err_builtin_target_unsupported)
2301 << SourceRange(TheCall->getBeginLoc(), TheCall->getEndLoc());
2302 return ExprError();
2303 }
2304 break;
2305 case Builtin::BI__builtin___CFStringMakeConstantString:
2306 // CFStringMakeConstantString is currently not implemented for GOFF (i.e.,
2307 // on z/OS) and for XCOFF (i.e., on AIX). Emit unsupported
2308 if (CheckBuiltinTargetNotInUnsupported(
2309 S&: *this, BuiltinID, TheCall,
2310 UnsupportedObjectFormatTypes: {llvm::Triple::GOFF, llvm::Triple::XCOFF}))
2311 return ExprError();
2312 assert(TheCall->getNumArgs() == 1 &&
2313 "Wrong # arguments to builtin CFStringMakeConstantString");
2314 if (ObjC().CheckObjCString(Arg: TheCall->getArg(Arg: 0)))
2315 return ExprError();
2316 break;
2317 case Builtin::BI__builtin_ms_va_start:
2318 case Builtin::BI__builtin_stdarg_start:
2319 case Builtin::BI__builtin_va_start:
2320 case Builtin::BI__builtin_c23_va_start:
2321 if (BuiltinVAStart(BuiltinID, TheCall))
2322 return ExprError();
2323 break;
2324 case Builtin::BI__va_start: {
2325 switch (Context.getTargetInfo().getTriple().getArch()) {
2326 case llvm::Triple::aarch64:
2327 case llvm::Triple::arm:
2328 case llvm::Triple::thumb:
2329 if (BuiltinVAStartARMMicrosoft(Call: TheCall))
2330 return ExprError();
2331 break;
2332 default:
2333 if (BuiltinVAStart(BuiltinID, TheCall))
2334 return ExprError();
2335 break;
2336 }
2337 break;
2338 }
2339
2340 // The acquire, release, and no fence variants are ARM and AArch64 only.
2341 case Builtin::BI_interlockedbittestandset_acq:
2342 case Builtin::BI_interlockedbittestandset_rel:
2343 case Builtin::BI_interlockedbittestandset_nf:
2344 case Builtin::BI_interlockedbittestandreset_acq:
2345 case Builtin::BI_interlockedbittestandreset_rel:
2346 case Builtin::BI_interlockedbittestandreset_nf:
2347 if (CheckBuiltinTargetInSupported(
2348 S&: *this, TheCall,
2349 SupportedArchs: {llvm::Triple::arm, llvm::Triple::thumb, llvm::Triple::aarch64}))
2350 return ExprError();
2351 break;
2352
2353 // The 64-bit bittest variants are x64, ARM, and AArch64 only.
2354 case Builtin::BI_bittest64:
2355 case Builtin::BI_bittestandcomplement64:
2356 case Builtin::BI_bittestandreset64:
2357 case Builtin::BI_bittestandset64:
2358 case Builtin::BI_interlockedbittestandreset64:
2359 case Builtin::BI_interlockedbittestandset64:
2360 if (CheckBuiltinTargetInSupported(
2361 S&: *this, TheCall,
2362 SupportedArchs: {llvm::Triple::x86_64, llvm::Triple::arm, llvm::Triple::thumb,
2363 llvm::Triple::aarch64, llvm::Triple::amdgcn}))
2364 return ExprError();
2365 break;
2366
2367 case Builtin::BI__builtin_set_flt_rounds:
2368 if (CheckBuiltinTargetInSupported(
2369 S&: *this, TheCall,
2370 SupportedArchs: {llvm::Triple::x86, llvm::Triple::x86_64, llvm::Triple::arm,
2371 llvm::Triple::thumb, llvm::Triple::aarch64, llvm::Triple::amdgcn,
2372 llvm::Triple::ppc, llvm::Triple::ppc64, llvm::Triple::ppcle,
2373 llvm::Triple::ppc64le}))
2374 return ExprError();
2375 break;
2376
2377 case Builtin::BI__builtin_isgreater:
2378 case Builtin::BI__builtin_isgreaterequal:
2379 case Builtin::BI__builtin_isless:
2380 case Builtin::BI__builtin_islessequal:
2381 case Builtin::BI__builtin_islessgreater:
2382 case Builtin::BI__builtin_isunordered:
2383 if (BuiltinUnorderedCompare(TheCall, BuiltinID))
2384 return ExprError();
2385 break;
2386 case Builtin::BI__builtin_fpclassify:
2387 if (BuiltinFPClassification(TheCall, NumArgs: 6, BuiltinID))
2388 return ExprError();
2389 break;
2390 case Builtin::BI__builtin_isfpclass:
2391 if (BuiltinFPClassification(TheCall, NumArgs: 2, BuiltinID))
2392 return ExprError();
2393 break;
2394 case Builtin::BI__builtin_isfinite:
2395 case Builtin::BI__builtin_isinf:
2396 case Builtin::BI__builtin_isinf_sign:
2397 case Builtin::BI__builtin_isnan:
2398 case Builtin::BI__builtin_issignaling:
2399 case Builtin::BI__builtin_isnormal:
2400 case Builtin::BI__builtin_issubnormal:
2401 case Builtin::BI__builtin_iszero:
2402 case Builtin::BI__builtin_signbit:
2403 case Builtin::BI__builtin_signbitf:
2404 case Builtin::BI__builtin_signbitl:
2405 if (BuiltinFPClassification(TheCall, NumArgs: 1, BuiltinID))
2406 return ExprError();
2407 break;
2408 case Builtin::BI__builtin_shufflevector:
2409 return BuiltinShuffleVector(TheCall);
2410 // TheCall will be freed by the smart pointer here, but that's fine, since
2411 // BuiltinShuffleVector guts it, but then doesn't release it.
2412 case Builtin::BI__builtin_prefetch:
2413 if (BuiltinPrefetch(TheCall))
2414 return ExprError();
2415 break;
2416 case Builtin::BI__builtin_alloca_with_align:
2417 case Builtin::BI__builtin_alloca_with_align_uninitialized:
2418 if (BuiltinAllocaWithAlign(TheCall))
2419 return ExprError();
2420 [[fallthrough]];
2421 case Builtin::BI__builtin_alloca:
2422 case Builtin::BI__builtin_alloca_uninitialized:
2423 Diag(TheCall->getBeginLoc(), diag::warn_alloca)
2424 << TheCall->getDirectCallee();
2425 if (getLangOpts().OpenCL) {
2426 builtinAllocaAddrSpace(S&: *this, TheCall);
2427 }
2428 break;
2429 case Builtin::BI__arithmetic_fence:
2430 if (BuiltinArithmeticFence(TheCall))
2431 return ExprError();
2432 break;
2433 case Builtin::BI__assume:
2434 case Builtin::BI__builtin_assume:
2435 if (BuiltinAssume(TheCall))
2436 return ExprError();
2437 break;
2438 case Builtin::BI__builtin_assume_aligned:
2439 if (BuiltinAssumeAligned(TheCall))
2440 return ExprError();
2441 break;
2442 case Builtin::BI__builtin_dynamic_object_size:
2443 case Builtin::BI__builtin_object_size:
2444 if (BuiltinConstantArgRange(TheCall, ArgNum: 1, Low: 0, High: 3))
2445 return ExprError();
2446 break;
2447 case Builtin::BI__builtin_longjmp:
2448 if (BuiltinLongjmp(TheCall))
2449 return ExprError();
2450 break;
2451 case Builtin::BI__builtin_setjmp:
2452 if (BuiltinSetjmp(TheCall))
2453 return ExprError();
2454 break;
2455 case Builtin::BI__builtin_classify_type:
2456 if (checkArgCount(Call: TheCall, DesiredArgCount: 1))
2457 return true;
2458 TheCall->setType(Context.IntTy);
2459 break;
2460 case Builtin::BI__builtin_complex:
2461 if (BuiltinComplex(TheCall))
2462 return ExprError();
2463 break;
2464 case Builtin::BI__builtin_constant_p: {
2465 if (checkArgCount(Call: TheCall, DesiredArgCount: 1))
2466 return true;
2467 ExprResult Arg = DefaultFunctionArrayLvalueConversion(E: TheCall->getArg(Arg: 0));
2468 if (Arg.isInvalid()) return true;
2469 TheCall->setArg(Arg: 0, ArgExpr: Arg.get());
2470 TheCall->setType(Context.IntTy);
2471 break;
2472 }
2473 case Builtin::BI__builtin_launder:
2474 return BuiltinLaunder(S&: *this, TheCall);
2475 case Builtin::BI__builtin_is_within_lifetime:
2476 return BuiltinIsWithinLifetime(S&: *this, TheCall);
2477 case Builtin::BI__builtin_trivially_relocate:
2478 return BuiltinTriviallyRelocate(S&: *this, TheCall);
2479
2480 case Builtin::BI__sync_fetch_and_add:
2481 case Builtin::BI__sync_fetch_and_add_1:
2482 case Builtin::BI__sync_fetch_and_add_2:
2483 case Builtin::BI__sync_fetch_and_add_4:
2484 case Builtin::BI__sync_fetch_and_add_8:
2485 case Builtin::BI__sync_fetch_and_add_16:
2486 case Builtin::BI__sync_fetch_and_sub:
2487 case Builtin::BI__sync_fetch_and_sub_1:
2488 case Builtin::BI__sync_fetch_and_sub_2:
2489 case Builtin::BI__sync_fetch_and_sub_4:
2490 case Builtin::BI__sync_fetch_and_sub_8:
2491 case Builtin::BI__sync_fetch_and_sub_16:
2492 case Builtin::BI__sync_fetch_and_or:
2493 case Builtin::BI__sync_fetch_and_or_1:
2494 case Builtin::BI__sync_fetch_and_or_2:
2495 case Builtin::BI__sync_fetch_and_or_4:
2496 case Builtin::BI__sync_fetch_and_or_8:
2497 case Builtin::BI__sync_fetch_and_or_16:
2498 case Builtin::BI__sync_fetch_and_and:
2499 case Builtin::BI__sync_fetch_and_and_1:
2500 case Builtin::BI__sync_fetch_and_and_2:
2501 case Builtin::BI__sync_fetch_and_and_4:
2502 case Builtin::BI__sync_fetch_and_and_8:
2503 case Builtin::BI__sync_fetch_and_and_16:
2504 case Builtin::BI__sync_fetch_and_xor:
2505 case Builtin::BI__sync_fetch_and_xor_1:
2506 case Builtin::BI__sync_fetch_and_xor_2:
2507 case Builtin::BI__sync_fetch_and_xor_4:
2508 case Builtin::BI__sync_fetch_and_xor_8:
2509 case Builtin::BI__sync_fetch_and_xor_16:
2510 case Builtin::BI__sync_fetch_and_nand:
2511 case Builtin::BI__sync_fetch_and_nand_1:
2512 case Builtin::BI__sync_fetch_and_nand_2:
2513 case Builtin::BI__sync_fetch_and_nand_4:
2514 case Builtin::BI__sync_fetch_and_nand_8:
2515 case Builtin::BI__sync_fetch_and_nand_16:
2516 case Builtin::BI__sync_add_and_fetch:
2517 case Builtin::BI__sync_add_and_fetch_1:
2518 case Builtin::BI__sync_add_and_fetch_2:
2519 case Builtin::BI__sync_add_and_fetch_4:
2520 case Builtin::BI__sync_add_and_fetch_8:
2521 case Builtin::BI__sync_add_and_fetch_16:
2522 case Builtin::BI__sync_sub_and_fetch:
2523 case Builtin::BI__sync_sub_and_fetch_1:
2524 case Builtin::BI__sync_sub_and_fetch_2:
2525 case Builtin::BI__sync_sub_and_fetch_4:
2526 case Builtin::BI__sync_sub_and_fetch_8:
2527 case Builtin::BI__sync_sub_and_fetch_16:
2528 case Builtin::BI__sync_and_and_fetch:
2529 case Builtin::BI__sync_and_and_fetch_1:
2530 case Builtin::BI__sync_and_and_fetch_2:
2531 case Builtin::BI__sync_and_and_fetch_4:
2532 case Builtin::BI__sync_and_and_fetch_8:
2533 case Builtin::BI__sync_and_and_fetch_16:
2534 case Builtin::BI__sync_or_and_fetch:
2535 case Builtin::BI__sync_or_and_fetch_1:
2536 case Builtin::BI__sync_or_and_fetch_2:
2537 case Builtin::BI__sync_or_and_fetch_4:
2538 case Builtin::BI__sync_or_and_fetch_8:
2539 case Builtin::BI__sync_or_and_fetch_16:
2540 case Builtin::BI__sync_xor_and_fetch:
2541 case Builtin::BI__sync_xor_and_fetch_1:
2542 case Builtin::BI__sync_xor_and_fetch_2:
2543 case Builtin::BI__sync_xor_and_fetch_4:
2544 case Builtin::BI__sync_xor_and_fetch_8:
2545 case Builtin::BI__sync_xor_and_fetch_16:
2546 case Builtin::BI__sync_nand_and_fetch:
2547 case Builtin::BI__sync_nand_and_fetch_1:
2548 case Builtin::BI__sync_nand_and_fetch_2:
2549 case Builtin::BI__sync_nand_and_fetch_4:
2550 case Builtin::BI__sync_nand_and_fetch_8:
2551 case Builtin::BI__sync_nand_and_fetch_16:
2552 case Builtin::BI__sync_val_compare_and_swap:
2553 case Builtin::BI__sync_val_compare_and_swap_1:
2554 case Builtin::BI__sync_val_compare_and_swap_2:
2555 case Builtin::BI__sync_val_compare_and_swap_4:
2556 case Builtin::BI__sync_val_compare_and_swap_8:
2557 case Builtin::BI__sync_val_compare_and_swap_16:
2558 case Builtin::BI__sync_bool_compare_and_swap:
2559 case Builtin::BI__sync_bool_compare_and_swap_1:
2560 case Builtin::BI__sync_bool_compare_and_swap_2:
2561 case Builtin::BI__sync_bool_compare_and_swap_4:
2562 case Builtin::BI__sync_bool_compare_and_swap_8:
2563 case Builtin::BI__sync_bool_compare_and_swap_16:
2564 case Builtin::BI__sync_lock_test_and_set:
2565 case Builtin::BI__sync_lock_test_and_set_1:
2566 case Builtin::BI__sync_lock_test_and_set_2:
2567 case Builtin::BI__sync_lock_test_and_set_4:
2568 case Builtin::BI__sync_lock_test_and_set_8:
2569 case Builtin::BI__sync_lock_test_and_set_16:
2570 case Builtin::BI__sync_lock_release:
2571 case Builtin::BI__sync_lock_release_1:
2572 case Builtin::BI__sync_lock_release_2:
2573 case Builtin::BI__sync_lock_release_4:
2574 case Builtin::BI__sync_lock_release_8:
2575 case Builtin::BI__sync_lock_release_16:
2576 case Builtin::BI__sync_swap:
2577 case Builtin::BI__sync_swap_1:
2578 case Builtin::BI__sync_swap_2:
2579 case Builtin::BI__sync_swap_4:
2580 case Builtin::BI__sync_swap_8:
2581 case Builtin::BI__sync_swap_16:
2582 return BuiltinAtomicOverloaded(TheCallResult);
2583 case Builtin::BI__sync_synchronize:
2584 Diag(TheCall->getBeginLoc(), diag::warn_atomic_implicit_seq_cst)
2585 << TheCall->getCallee()->getSourceRange();
2586 break;
2587 case Builtin::BI__builtin_nontemporal_load:
2588 case Builtin::BI__builtin_nontemporal_store:
2589 return BuiltinNontemporalOverloaded(TheCallResult);
2590 case Builtin::BI__builtin_memcpy_inline: {
2591 clang::Expr *SizeOp = TheCall->getArg(Arg: 2);
2592 // We warn about copying to or from `nullptr` pointers when `size` is
2593 // greater than 0. When `size` is value dependent we cannot evaluate its
2594 // value so we bail out.
2595 if (SizeOp->isValueDependent())
2596 break;
2597 if (!SizeOp->EvaluateKnownConstInt(Ctx: Context).isZero()) {
2598 CheckNonNullArgument(*this, TheCall->getArg(Arg: 0), TheCall->getExprLoc());
2599 CheckNonNullArgument(*this, TheCall->getArg(Arg: 1), TheCall->getExprLoc());
2600 }
2601 break;
2602 }
2603 case Builtin::BI__builtin_memset_inline: {
2604 clang::Expr *SizeOp = TheCall->getArg(Arg: 2);
2605 // We warn about filling to `nullptr` pointers when `size` is greater than
2606 // 0. When `size` is value dependent we cannot evaluate its value so we bail
2607 // out.
2608 if (SizeOp->isValueDependent())
2609 break;
2610 if (!SizeOp->EvaluateKnownConstInt(Ctx: Context).isZero())
2611 CheckNonNullArgument(*this, TheCall->getArg(Arg: 0), TheCall->getExprLoc());
2612 break;
2613 }
2614#define ATOMIC_BUILTIN(ID, TYPE, ATTRS) \
2615 case Builtin::BI##ID: \
2616 return AtomicOpsOverloaded(TheCallResult, AtomicExpr::AO##ID);
2617#include "clang/Basic/Builtins.inc"
2618 case Builtin::BI__annotation:
2619 if (BuiltinMSVCAnnotation(S&: *this, TheCall))
2620 return ExprError();
2621 break;
2622 case Builtin::BI__builtin_annotation:
2623 if (BuiltinAnnotation(S&: *this, TheCall))
2624 return ExprError();
2625 break;
2626 case Builtin::BI__builtin_addressof:
2627 if (BuiltinAddressof(S&: *this, TheCall))
2628 return ExprError();
2629 break;
2630 case Builtin::BI__builtin_function_start:
2631 if (BuiltinFunctionStart(S&: *this, TheCall))
2632 return ExprError();
2633 break;
2634 case Builtin::BI__builtin_is_aligned:
2635 case Builtin::BI__builtin_align_up:
2636 case Builtin::BI__builtin_align_down:
2637 if (BuiltinAlignment(S&: *this, TheCall, ID: BuiltinID))
2638 return ExprError();
2639 break;
2640 case Builtin::BI__builtin_add_overflow:
2641 case Builtin::BI__builtin_sub_overflow:
2642 case Builtin::BI__builtin_mul_overflow:
2643 if (BuiltinOverflow(S&: *this, TheCall, BuiltinID))
2644 return ExprError();
2645 break;
2646 case Builtin::BI__builtin_operator_new:
2647 case Builtin::BI__builtin_operator_delete: {
2648 bool IsDelete = BuiltinID == Builtin::BI__builtin_operator_delete;
2649 ExprResult Res =
2650 BuiltinOperatorNewDeleteOverloaded(TheCallResult, IsDelete);
2651 if (Res.isInvalid())
2652 CorrectDelayedTyposInExpr(E: TheCallResult.get());
2653 return Res;
2654 }
2655 case Builtin::BI__builtin_dump_struct:
2656 return BuiltinDumpStruct(S&: *this, TheCall);
2657 case Builtin::BI__builtin_expect_with_probability: {
2658 // We first want to ensure we are called with 3 arguments
2659 if (checkArgCount(Call: TheCall, DesiredArgCount: 3))
2660 return ExprError();
2661 // then check probability is constant float in range [0.0, 1.0]
2662 const Expr *ProbArg = TheCall->getArg(Arg: 2);
2663 SmallVector<PartialDiagnosticAt, 8> Notes;
2664 Expr::EvalResult Eval;
2665 Eval.Diag = &Notes;
2666 if ((!ProbArg->EvaluateAsConstantExpr(Result&: Eval, Ctx: Context)) ||
2667 !Eval.Val.isFloat()) {
2668 Diag(ProbArg->getBeginLoc(), diag::err_probability_not_constant_float)
2669 << ProbArg->getSourceRange();
2670 for (const PartialDiagnosticAt &PDiag : Notes)
2671 Diag(PDiag.first, PDiag.second);
2672 return ExprError();
2673 }
2674 llvm::APFloat Probability = Eval.Val.getFloat();
2675 bool LoseInfo = false;
2676 Probability.convert(ToSemantics: llvm::APFloat::IEEEdouble(),
2677 RM: llvm::RoundingMode::Dynamic, losesInfo: &LoseInfo);
2678 if (!(Probability >= llvm::APFloat(0.0) &&
2679 Probability <= llvm::APFloat(1.0))) {
2680 Diag(ProbArg->getBeginLoc(), diag::err_probability_out_of_range)
2681 << ProbArg->getSourceRange();
2682 return ExprError();
2683 }
2684 break;
2685 }
2686 case Builtin::BI__builtin_preserve_access_index:
2687 if (BuiltinPreserveAI(S&: *this, TheCall))
2688 return ExprError();
2689 break;
2690 case Builtin::BI__builtin_call_with_static_chain:
2691 if (BuiltinCallWithStaticChain(S&: *this, BuiltinCall: TheCall))
2692 return ExprError();
2693 break;
2694 case Builtin::BI__exception_code:
2695 case Builtin::BI_exception_code:
2696 if (BuiltinSEHScopeCheck(*this, TheCall, Scope::SEHExceptScope,
2697 diag::err_seh___except_block))
2698 return ExprError();
2699 break;
2700 case Builtin::BI__exception_info:
2701 case Builtin::BI_exception_info:
2702 if (BuiltinSEHScopeCheck(*this, TheCall, Scope::SEHFilterScope,
2703 diag::err_seh___except_filter))
2704 return ExprError();
2705 break;
2706 case Builtin::BI__GetExceptionInfo:
2707 if (checkArgCount(Call: TheCall, DesiredArgCount: 1))
2708 return ExprError();
2709
2710 if (CheckCXXThrowOperand(
2711 ThrowLoc: TheCall->getBeginLoc(),
2712 ThrowTy: Context.getExceptionObjectType(T: FDecl->getParamDecl(i: 0)->getType()),
2713 E: TheCall))
2714 return ExprError();
2715
2716 TheCall->setType(Context.VoidPtrTy);
2717 break;
2718 case Builtin::BIaddressof:
2719 case Builtin::BI__addressof:
2720 case Builtin::BIforward:
2721 case Builtin::BIforward_like:
2722 case Builtin::BImove:
2723 case Builtin::BImove_if_noexcept:
2724 case Builtin::BIas_const: {
2725 // These are all expected to be of the form
2726 // T &/&&/* f(U &/&&)
2727 // where T and U only differ in qualification.
2728 if (checkArgCount(Call: TheCall, DesiredArgCount: 1))
2729 return ExprError();
2730 QualType Param = FDecl->getParamDecl(i: 0)->getType();
2731 QualType Result = FDecl->getReturnType();
2732 bool ReturnsPointer = BuiltinID == Builtin::BIaddressof ||
2733 BuiltinID == Builtin::BI__addressof;
2734 if (!(Param->isReferenceType() &&
2735 (ReturnsPointer ? Result->isAnyPointerType()
2736 : Result->isReferenceType()) &&
2737 Context.hasSameUnqualifiedType(T1: Param->getPointeeType(),
2738 T2: Result->getPointeeType()))) {
2739 Diag(TheCall->getBeginLoc(), diag::err_builtin_move_forward_unsupported)
2740 << FDecl;
2741 return ExprError();
2742 }
2743 break;
2744 }
2745 case Builtin::BI__builtin_ptrauth_strip:
2746 return PointerAuthStrip(S&: *this, Call: TheCall);
2747 case Builtin::BI__builtin_ptrauth_blend_discriminator:
2748 return PointerAuthBlendDiscriminator(S&: *this, Call: TheCall);
2749 case Builtin::BI__builtin_ptrauth_sign_constant:
2750 return PointerAuthSignOrAuth(S&: *this, Call: TheCall, OpKind: PAO_Sign,
2751 /*RequireConstant=*/true);
2752 case Builtin::BI__builtin_ptrauth_sign_unauthenticated:
2753 return PointerAuthSignOrAuth(S&: *this, Call: TheCall, OpKind: PAO_Sign,
2754 /*RequireConstant=*/false);
2755 case Builtin::BI__builtin_ptrauth_auth:
2756 return PointerAuthSignOrAuth(S&: *this, Call: TheCall, OpKind: PAO_Auth,
2757 /*RequireConstant=*/false);
2758 case Builtin::BI__builtin_ptrauth_sign_generic_data:
2759 return PointerAuthSignGenericData(S&: *this, Call: TheCall);
2760 case Builtin::BI__builtin_ptrauth_auth_and_resign:
2761 return PointerAuthAuthAndResign(S&: *this, Call: TheCall);
2762 case Builtin::BI__builtin_ptrauth_string_discriminator:
2763 return PointerAuthStringDiscriminator(S&: *this, Call: TheCall);
2764
2765 case Builtin::BI__builtin_get_vtable_pointer:
2766 return GetVTablePointer(S&: *this, Call: TheCall);
2767
2768 // OpenCL v2.0, s6.13.16 - Pipe functions
2769 case Builtin::BIread_pipe:
2770 case Builtin::BIwrite_pipe:
2771 // Since those two functions are declared with var args, we need a semantic
2772 // check for the argument.
2773 if (OpenCL().checkBuiltinRWPipe(Call: TheCall))
2774 return ExprError();
2775 break;
2776 case Builtin::BIreserve_read_pipe:
2777 case Builtin::BIreserve_write_pipe:
2778 case Builtin::BIwork_group_reserve_read_pipe:
2779 case Builtin::BIwork_group_reserve_write_pipe:
2780 if (OpenCL().checkBuiltinReserveRWPipe(Call: TheCall))
2781 return ExprError();
2782 break;
2783 case Builtin::BIsub_group_reserve_read_pipe:
2784 case Builtin::BIsub_group_reserve_write_pipe:
2785 if (OpenCL().checkSubgroupExt(Call: TheCall) ||
2786 OpenCL().checkBuiltinReserveRWPipe(Call: TheCall))
2787 return ExprError();
2788 break;
2789 case Builtin::BIcommit_read_pipe:
2790 case Builtin::BIcommit_write_pipe:
2791 case Builtin::BIwork_group_commit_read_pipe:
2792 case Builtin::BIwork_group_commit_write_pipe:
2793 if (OpenCL().checkBuiltinCommitRWPipe(Call: TheCall))
2794 return ExprError();
2795 break;
2796 case Builtin::BIsub_group_commit_read_pipe:
2797 case Builtin::BIsub_group_commit_write_pipe:
2798 if (OpenCL().checkSubgroupExt(Call: TheCall) ||
2799 OpenCL().checkBuiltinCommitRWPipe(Call: TheCall))
2800 return ExprError();
2801 break;
2802 case Builtin::BIget_pipe_num_packets:
2803 case Builtin::BIget_pipe_max_packets:
2804 if (OpenCL().checkBuiltinPipePackets(Call: TheCall))
2805 return ExprError();
2806 break;
2807 case Builtin::BIto_global:
2808 case Builtin::BIto_local:
2809 case Builtin::BIto_private:
2810 if (OpenCL().checkBuiltinToAddr(BuiltinID, Call: TheCall))
2811 return ExprError();
2812 break;
2813 // OpenCL v2.0, s6.13.17 - Enqueue kernel functions.
2814 case Builtin::BIenqueue_kernel:
2815 if (OpenCL().checkBuiltinEnqueueKernel(TheCall))
2816 return ExprError();
2817 break;
2818 case Builtin::BIget_kernel_work_group_size:
2819 case Builtin::BIget_kernel_preferred_work_group_size_multiple:
2820 if (OpenCL().checkBuiltinKernelWorkGroupSize(TheCall))
2821 return ExprError();
2822 break;
2823 case Builtin::BIget_kernel_max_sub_group_size_for_ndrange:
2824 case Builtin::BIget_kernel_sub_group_count_for_ndrange:
2825 if (OpenCL().checkBuiltinNDRangeAndBlock(TheCall))
2826 return ExprError();
2827 break;
2828 case Builtin::BI__builtin_os_log_format:
2829 Cleanup.setExprNeedsCleanups(true);
2830 [[fallthrough]];
2831 case Builtin::BI__builtin_os_log_format_buffer_size:
2832 if (BuiltinOSLogFormat(TheCall))
2833 return ExprError();
2834 break;
2835 case Builtin::BI__builtin_frame_address:
2836 case Builtin::BI__builtin_return_address: {
2837 if (BuiltinConstantArgRange(TheCall, ArgNum: 0, Low: 0, High: 0xFFFF))
2838 return ExprError();
2839
2840 // -Wframe-address warning if non-zero passed to builtin
2841 // return/frame address.
2842 Expr::EvalResult Result;
2843 if (!TheCall->getArg(0)->isValueDependent() &&
2844 TheCall->getArg(0)->EvaluateAsInt(Result, getASTContext()) &&
2845 Result.Val.getInt() != 0)
2846 Diag(TheCall->getBeginLoc(), diag::warn_frame_address)
2847 << ((BuiltinID == Builtin::BI__builtin_return_address)
2848 ? "__builtin_return_address"
2849 : "__builtin_frame_address")
2850 << TheCall->getSourceRange();
2851 break;
2852 }
2853
2854 case Builtin::BI__builtin_nondeterministic_value: {
2855 if (BuiltinNonDeterministicValue(TheCall))
2856 return ExprError();
2857 break;
2858 }
2859
2860 // __builtin_elementwise_abs restricts the element type to signed integers or
2861 // floating point types only.
2862 case Builtin::BI__builtin_elementwise_abs:
2863 if (PrepareBuiltinElementwiseMathOneArgCall(
2864 TheCall, ArgTyRestr: EltwiseBuiltinArgTyRestriction::SignedIntOrFloatTy))
2865 return ExprError();
2866 break;
2867
2868 // These builtins restrict the element type to floating point
2869 // types only.
2870 case Builtin::BI__builtin_elementwise_acos:
2871 case Builtin::BI__builtin_elementwise_asin:
2872 case Builtin::BI__builtin_elementwise_atan:
2873 case Builtin::BI__builtin_elementwise_ceil:
2874 case Builtin::BI__builtin_elementwise_cos:
2875 case Builtin::BI__builtin_elementwise_cosh:
2876 case Builtin::BI__builtin_elementwise_exp:
2877 case Builtin::BI__builtin_elementwise_exp2:
2878 case Builtin::BI__builtin_elementwise_exp10:
2879 case Builtin::BI__builtin_elementwise_floor:
2880 case Builtin::BI__builtin_elementwise_log:
2881 case Builtin::BI__builtin_elementwise_log2:
2882 case Builtin::BI__builtin_elementwise_log10:
2883 case Builtin::BI__builtin_elementwise_roundeven:
2884 case Builtin::BI__builtin_elementwise_round:
2885 case Builtin::BI__builtin_elementwise_rint:
2886 case Builtin::BI__builtin_elementwise_nearbyint:
2887 case Builtin::BI__builtin_elementwise_sin:
2888 case Builtin::BI__builtin_elementwise_sinh:
2889 case Builtin::BI__builtin_elementwise_sqrt:
2890 case Builtin::BI__builtin_elementwise_tan:
2891 case Builtin::BI__builtin_elementwise_tanh:
2892 case Builtin::BI__builtin_elementwise_trunc:
2893 case Builtin::BI__builtin_elementwise_canonicalize:
2894 if (PrepareBuiltinElementwiseMathOneArgCall(
2895 TheCall, ArgTyRestr: EltwiseBuiltinArgTyRestriction::FloatTy))
2896 return ExprError();
2897 break;
2898 case Builtin::BI__builtin_elementwise_fma:
2899 if (BuiltinElementwiseTernaryMath(TheCall))
2900 return ExprError();
2901 break;
2902
2903 // These builtins restrict the element type to floating point
2904 // types only, and take in two arguments.
2905 case Builtin::BI__builtin_elementwise_minnum:
2906 case Builtin::BI__builtin_elementwise_maxnum:
2907 case Builtin::BI__builtin_elementwise_minimum:
2908 case Builtin::BI__builtin_elementwise_maximum:
2909 case Builtin::BI__builtin_elementwise_atan2:
2910 case Builtin::BI__builtin_elementwise_fmod:
2911 case Builtin::BI__builtin_elementwise_pow:
2912 if (BuiltinElementwiseMath(TheCall,
2913 ArgTyRestr: EltwiseBuiltinArgTyRestriction::FloatTy))
2914 return ExprError();
2915 break;
2916 // These builtins restrict the element type to integer
2917 // types only.
2918 case Builtin::BI__builtin_elementwise_add_sat:
2919 case Builtin::BI__builtin_elementwise_sub_sat:
2920 if (BuiltinElementwiseMath(TheCall,
2921 ArgTyRestr: EltwiseBuiltinArgTyRestriction::IntegerTy))
2922 return ExprError();
2923 break;
2924 case Builtin::BI__builtin_elementwise_min:
2925 case Builtin::BI__builtin_elementwise_max:
2926 if (BuiltinElementwiseMath(TheCall))
2927 return ExprError();
2928 break;
2929 case Builtin::BI__builtin_elementwise_popcount:
2930 case Builtin::BI__builtin_elementwise_bitreverse:
2931 if (PrepareBuiltinElementwiseMathOneArgCall(
2932 TheCall, ArgTyRestr: EltwiseBuiltinArgTyRestriction::IntegerTy))
2933 return ExprError();
2934 break;
2935 case Builtin::BI__builtin_elementwise_copysign: {
2936 if (checkArgCount(Call: TheCall, DesiredArgCount: 2))
2937 return ExprError();
2938
2939 ExprResult Magnitude = UsualUnaryConversions(E: TheCall->getArg(Arg: 0));
2940 ExprResult Sign = UsualUnaryConversions(E: TheCall->getArg(Arg: 1));
2941 if (Magnitude.isInvalid() || Sign.isInvalid())
2942 return ExprError();
2943
2944 QualType MagnitudeTy = Magnitude.get()->getType();
2945 QualType SignTy = Sign.get()->getType();
2946 if (checkMathBuiltinElementType(
2947 *this, TheCall->getArg(Arg: 0)->getBeginLoc(), MagnitudeTy,
2948 EltwiseBuiltinArgTyRestriction::FloatTy, 1) ||
2949 checkMathBuiltinElementType(
2950 *this, TheCall->getArg(Arg: 1)->getBeginLoc(), SignTy,
2951 EltwiseBuiltinArgTyRestriction::FloatTy, 2)) {
2952 return ExprError();
2953 }
2954
2955 if (MagnitudeTy.getCanonicalType() != SignTy.getCanonicalType()) {
2956 return Diag(Sign.get()->getBeginLoc(),
2957 diag::err_typecheck_call_different_arg_types)
2958 << MagnitudeTy << SignTy;
2959 }
2960
2961 TheCall->setArg(Arg: 0, ArgExpr: Magnitude.get());
2962 TheCall->setArg(Arg: 1, ArgExpr: Sign.get());
2963 TheCall->setType(Magnitude.get()->getType());
2964 break;
2965 }
2966 case Builtin::BI__builtin_reduce_max:
2967 case Builtin::BI__builtin_reduce_min: {
2968 if (PrepareBuiltinReduceMathOneArgCall(TheCall))
2969 return ExprError();
2970
2971 const Expr *Arg = TheCall->getArg(Arg: 0);
2972 const auto *TyA = Arg->getType()->getAs<VectorType>();
2973
2974 QualType ElTy;
2975 if (TyA)
2976 ElTy = TyA->getElementType();
2977 else if (Arg->getType()->isSizelessVectorType())
2978 ElTy = Arg->getType()->getSizelessVectorEltType(Ctx: Context);
2979
2980 if (ElTy.isNull()) {
2981 Diag(Arg->getBeginLoc(), diag::err_builtin_invalid_arg_type)
2982 << 1 << /* vector ty */ 2 << /* no int */ 0 << /* no fp */ 0
2983 << Arg->getType();
2984 return ExprError();
2985 }
2986
2987 TheCall->setType(ElTy);
2988 break;
2989 }
2990 case Builtin::BI__builtin_reduce_maximum:
2991 case Builtin::BI__builtin_reduce_minimum: {
2992 if (PrepareBuiltinReduceMathOneArgCall(TheCall))
2993 return ExprError();
2994
2995 const Expr *Arg = TheCall->getArg(Arg: 0);
2996 const auto *TyA = Arg->getType()->getAs<VectorType>();
2997
2998 QualType ElTy;
2999 if (TyA)
3000 ElTy = TyA->getElementType();
3001 else if (Arg->getType()->isSizelessVectorType())
3002 ElTy = Arg->getType()->getSizelessVectorEltType(Ctx: Context);
3003
3004 if (ElTy.isNull() || !ElTy->isFloatingType()) {
3005 Diag(Arg->getBeginLoc(), diag::err_builtin_invalid_arg_type)
3006 << 1 << /* vector of */ 4 << /* no int */ 0 << /* fp */ 1
3007 << Arg->getType();
3008 return ExprError();
3009 }
3010
3011 TheCall->setType(ElTy);
3012 break;
3013 }
3014
3015 // These builtins support vectors of integers only.
3016 // TODO: ADD/MUL should support floating-point types.
3017 case Builtin::BI__builtin_reduce_add:
3018 case Builtin::BI__builtin_reduce_mul:
3019 case Builtin::BI__builtin_reduce_xor:
3020 case Builtin::BI__builtin_reduce_or:
3021 case Builtin::BI__builtin_reduce_and: {
3022 if (PrepareBuiltinReduceMathOneArgCall(TheCall))
3023 return ExprError();
3024
3025 const Expr *Arg = TheCall->getArg(Arg: 0);
3026 const auto *TyA = Arg->getType()->getAs<VectorType>();
3027
3028 QualType ElTy;
3029 if (TyA)
3030 ElTy = TyA->getElementType();
3031 else if (Arg->getType()->isSizelessVectorType())
3032 ElTy = Arg->getType()->getSizelessVectorEltType(Ctx: Context);
3033
3034 if (ElTy.isNull() || !ElTy->isIntegerType()) {
3035 Diag(Arg->getBeginLoc(), diag::err_builtin_invalid_arg_type)
3036 << 1 << /* vector of */ 4 << /* int */ 1 << /* no fp */ 0
3037 << Arg->getType();
3038 return ExprError();
3039 }
3040
3041 TheCall->setType(ElTy);
3042 break;
3043 }
3044
3045 case Builtin::BI__builtin_matrix_transpose:
3046 return BuiltinMatrixTranspose(TheCall, CallResult: TheCallResult);
3047
3048 case Builtin::BI__builtin_matrix_column_major_load:
3049 return BuiltinMatrixColumnMajorLoad(TheCall, CallResult: TheCallResult);
3050
3051 case Builtin::BI__builtin_matrix_column_major_store:
3052 return BuiltinMatrixColumnMajorStore(TheCall, CallResult: TheCallResult);
3053
3054 case Builtin::BI__builtin_verbose_trap:
3055 if (!checkBuiltinVerboseTrap(Call: TheCall, S&: *this))
3056 return ExprError();
3057 break;
3058
3059 case Builtin::BI__builtin_get_device_side_mangled_name: {
3060 auto Check = [](CallExpr *TheCall) {
3061 if (TheCall->getNumArgs() != 1)
3062 return false;
3063 auto *DRE = dyn_cast<DeclRefExpr>(TheCall->getArg(Arg: 0)->IgnoreImpCasts());
3064 if (!DRE)
3065 return false;
3066 auto *D = DRE->getDecl();
3067 if (!isa<FunctionDecl>(D) && !isa<VarDecl>(D))
3068 return false;
3069 return D->hasAttr<CUDAGlobalAttr>() || D->hasAttr<CUDADeviceAttr>() ||
3070 D->hasAttr<CUDAConstantAttr>() || D->hasAttr<HIPManagedAttr>();
3071 };
3072 if (!Check(TheCall)) {
3073 Diag(TheCall->getBeginLoc(),
3074 diag::err_hip_invalid_args_builtin_mangled_name);
3075 return ExprError();
3076 }
3077 break;
3078 }
3079 case Builtin::BI__builtin_popcountg:
3080 if (BuiltinPopcountg(S&: *this, TheCall))
3081 return ExprError();
3082 break;
3083 case Builtin::BI__builtin_clzg:
3084 case Builtin::BI__builtin_ctzg:
3085 if (BuiltinCountZeroBitsGeneric(S&: *this, TheCall))
3086 return ExprError();
3087 break;
3088
3089 case Builtin::BI__builtin_allow_runtime_check: {
3090 Expr *Arg = TheCall->getArg(Arg: 0);
3091 // Check if the argument is a string literal.
3092 if (!isa<StringLiteral>(Arg->IgnoreParenImpCasts())) {
3093 Diag(TheCall->getBeginLoc(), diag::err_expr_not_string_literal)
3094 << Arg->getSourceRange();
3095 return ExprError();
3096 }
3097 break;
3098 }
3099 case Builtin::BI__builtin_counted_by_ref:
3100 if (BuiltinCountedByRef(TheCall))
3101 return ExprError();
3102 break;
3103 }
3104
3105 if (getLangOpts().HLSL && HLSL().CheckBuiltinFunctionCall(BuiltinID, TheCall))
3106 return ExprError();
3107
3108 // Since the target specific builtins for each arch overlap, only check those
3109 // of the arch we are compiling for.
3110 if (Context.BuiltinInfo.isTSBuiltin(ID: BuiltinID)) {
3111 if (Context.BuiltinInfo.isAuxBuiltinID(ID: BuiltinID)) {
3112 assert(Context.getAuxTargetInfo() &&
3113 "Aux Target Builtin, but not an aux target?");
3114
3115 if (CheckTSBuiltinFunctionCall(
3116 TI: *Context.getAuxTargetInfo(),
3117 BuiltinID: Context.BuiltinInfo.getAuxBuiltinID(ID: BuiltinID), TheCall))
3118 return ExprError();
3119 } else {
3120 if (CheckTSBuiltinFunctionCall(TI: Context.getTargetInfo(), BuiltinID,
3121 TheCall))
3122 return ExprError();
3123 }
3124 }
3125
3126 return TheCallResult;
3127}
3128
3129bool Sema::ValueIsRunOfOnes(CallExpr *TheCall, unsigned ArgNum) {
3130 llvm::APSInt Result;
3131 // We can't check the value of a dependent argument.
3132 Expr *Arg = TheCall->getArg(Arg: ArgNum);
3133 if (Arg->isTypeDependent() || Arg->isValueDependent())
3134 return false;
3135
3136 // Check constant-ness first.
3137 if (BuiltinConstantArg(TheCall, ArgNum, Result))
3138 return true;
3139
3140 // Check contiguous run of 1s, 0xFF0000FF is also a run of 1s.
3141 if (Result.isShiftedMask() || (~Result).isShiftedMask())
3142 return false;
3143
3144 return Diag(TheCall->getBeginLoc(),
3145 diag::err_argument_not_contiguous_bit_field)
3146 << ArgNum << Arg->getSourceRange();
3147}
3148
3149bool Sema::getFormatStringInfo(const Decl *D, unsigned FormatIdx,
3150 unsigned FirstArg, FormatStringInfo *FSI) {
3151 bool IsCXXMember = false;
3152 if (const auto *MD = dyn_cast<CXXMethodDecl>(Val: D))
3153 IsCXXMember = MD->isInstance();
3154 bool IsVariadic = false;
3155 if (const FunctionType *FnTy = D->getFunctionType())
3156 IsVariadic = cast<FunctionProtoType>(Val: FnTy)->isVariadic();
3157 else if (const auto *BD = dyn_cast<BlockDecl>(Val: D))
3158 IsVariadic = BD->isVariadic();
3159 else if (const auto *OMD = dyn_cast<ObjCMethodDecl>(Val: D))
3160 IsVariadic = OMD->isVariadic();
3161
3162 return getFormatStringInfo(FormatIdx, FirstArg, IsCXXMember, IsVariadic, FSI);
3163}
3164
3165bool Sema::getFormatStringInfo(unsigned FormatIdx, unsigned FirstArg,
3166 bool IsCXXMember, bool IsVariadic,
3167 FormatStringInfo *FSI) {
3168 if (FirstArg == 0)
3169 FSI->ArgPassingKind = FAPK_VAList;
3170 else if (IsVariadic)
3171 FSI->ArgPassingKind = FAPK_Variadic;
3172 else
3173 FSI->ArgPassingKind = FAPK_Fixed;
3174 FSI->FormatIdx = FormatIdx - 1;
3175 FSI->FirstDataArg = FSI->ArgPassingKind == FAPK_VAList ? 0 : FirstArg - 1;
3176
3177 // The way the format attribute works in GCC, the implicit this argument
3178 // of member functions is counted. However, it doesn't appear in our own
3179 // lists, so decrement format_idx in that case.
3180 if (IsCXXMember) {
3181 if(FSI->FormatIdx == 0)
3182 return false;
3183 --FSI->FormatIdx;
3184 if (FSI->FirstDataArg != 0)
3185 --FSI->FirstDataArg;
3186 }
3187 return true;
3188}
3189
3190/// Checks if a the given expression evaluates to null.
3191///
3192/// Returns true if the value evaluates to null.
3193static bool CheckNonNullExpr(Sema &S, const Expr *Expr) {
3194 // Treat (smart) pointers constructed from nullptr as null, whether we can
3195 // const-evaluate them or not.
3196 // This must happen first: the smart pointer expr might have _Nonnull type!
3197 if (isa<CXXNullPtrLiteralExpr>(
3198 Val: IgnoreExprNodes(E: Expr, Fns&: IgnoreImplicitAsWrittenSingleStep,
3199 Fns&: IgnoreElidableImplicitConstructorSingleStep)))
3200 return true;
3201
3202 // If the expression has non-null type, it doesn't evaluate to null.
3203 if (auto nullability = Expr->IgnoreImplicit()->getType()->getNullability()) {
3204 if (*nullability == NullabilityKind::NonNull)
3205 return false;
3206 }
3207
3208 // As a special case, transparent unions initialized with zero are
3209 // considered null for the purposes of the nonnull attribute.
3210 if (const RecordType *UT = Expr->getType()->getAsUnionType();
3211 UT && UT->getDecl()->hasAttr<TransparentUnionAttr>()) {
3212 if (const auto *CLE = dyn_cast<CompoundLiteralExpr>(Val: Expr))
3213 if (const auto *ILE = dyn_cast<InitListExpr>(Val: CLE->getInitializer()))
3214 Expr = ILE->getInit(Init: 0);
3215 }
3216
3217 bool Result;
3218 return (!Expr->isValueDependent() &&
3219 Expr->EvaluateAsBooleanCondition(Result, Ctx: S.Context) &&
3220 !Result);
3221}
3222
3223static void CheckNonNullArgument(Sema &S,
3224 const Expr *ArgExpr,
3225 SourceLocation CallSiteLoc) {
3226 if (CheckNonNullExpr(S, ArgExpr))
3227 S.DiagRuntimeBehavior(CallSiteLoc, ArgExpr,
3228 S.PDiag(diag::warn_null_arg)
3229 << ArgExpr->getSourceRange());
3230}
3231
3232/// Determine whether the given type has a non-null nullability annotation.
3233static bool isNonNullType(QualType type) {
3234 if (auto nullability = type->getNullability())
3235 return *nullability == NullabilityKind::NonNull;
3236
3237 return false;
3238}
3239
3240static void CheckNonNullArguments(Sema &S,
3241 const NamedDecl *FDecl,
3242 const FunctionProtoType *Proto,
3243 ArrayRef<const Expr *> Args,
3244 SourceLocation CallSiteLoc) {
3245 assert((FDecl || Proto) && "Need a function declaration or prototype");
3246
3247 // Already checked by constant evaluator.
3248 if (S.isConstantEvaluatedContext())
3249 return;
3250 // Check the attributes attached to the method/function itself.
3251 llvm::SmallBitVector NonNullArgs;
3252 if (FDecl) {
3253 // Handle the nonnull attribute on the function/method declaration itself.
3254 for (const auto *NonNull : FDecl->specific_attrs<NonNullAttr>()) {
3255 if (!NonNull->args_size()) {
3256 // Easy case: all pointer arguments are nonnull.
3257 for (const auto *Arg : Args)
3258 if (S.isValidPointerAttrType(Arg->getType()))
3259 CheckNonNullArgument(S, Arg, CallSiteLoc);
3260 return;
3261 }
3262
3263 for (const ParamIdx &Idx : NonNull->args()) {
3264 unsigned IdxAST = Idx.getASTIndex();
3265 if (IdxAST >= Args.size())
3266 continue;
3267 if (NonNullArgs.empty())
3268 NonNullArgs.resize(Args.size());
3269 NonNullArgs.set(IdxAST);
3270 }
3271 }
3272 }
3273
3274 if (FDecl && (isa<FunctionDecl>(Val: FDecl) || isa<ObjCMethodDecl>(Val: FDecl))) {
3275 // Handle the nonnull attribute on the parameters of the
3276 // function/method.
3277 ArrayRef<ParmVarDecl*> parms;
3278 if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(Val: FDecl))
3279 parms = FD->parameters();
3280 else
3281 parms = cast<ObjCMethodDecl>(Val: FDecl)->parameters();
3282
3283 unsigned ParamIndex = 0;
3284 for (ArrayRef<ParmVarDecl*>::iterator I = parms.begin(), E = parms.end();
3285 I != E; ++I, ++ParamIndex) {
3286 const ParmVarDecl *PVD = *I;
3287 if (PVD->hasAttr<NonNullAttr>() || isNonNullType(PVD->getType())) {
3288 if (NonNullArgs.empty())
3289 NonNullArgs.resize(N: Args.size());
3290
3291 NonNullArgs.set(ParamIndex);
3292 }
3293 }
3294 } else {
3295 // If we have a non-function, non-method declaration but no
3296 // function prototype, try to dig out the function prototype.
3297 if (!Proto) {
3298 if (const ValueDecl *VD = dyn_cast<ValueDecl>(Val: FDecl)) {
3299 QualType type = VD->getType().getNonReferenceType();
3300 if (auto pointerType = type->getAs<PointerType>())
3301 type = pointerType->getPointeeType();
3302 else if (auto blockType = type->getAs<BlockPointerType>())
3303 type = blockType->getPointeeType();
3304 // FIXME: data member pointers?
3305
3306 // Dig out the function prototype, if there is one.
3307 Proto = type->getAs<FunctionProtoType>();
3308 }
3309 }
3310
3311 // Fill in non-null argument information from the nullability
3312 // information on the parameter types (if we have them).
3313 if (Proto) {
3314 unsigned Index = 0;
3315 for (auto paramType : Proto->getParamTypes()) {
3316 if (isNonNullType(type: paramType)) {
3317 if (NonNullArgs.empty())
3318 NonNullArgs.resize(N: Args.size());
3319
3320 NonNullArgs.set(Index);
3321 }
3322
3323 ++Index;
3324 }
3325 }
3326 }
3327
3328 // Check for non-null arguments.
3329 for (unsigned ArgIndex = 0, ArgIndexEnd = NonNullArgs.size();
3330 ArgIndex != ArgIndexEnd; ++ArgIndex) {
3331 if (NonNullArgs[ArgIndex])
3332 CheckNonNullArgument(S, ArgExpr: Args[ArgIndex], CallSiteLoc: Args[ArgIndex]->getExprLoc());
3333 }
3334}
3335
3336void Sema::CheckArgAlignment(SourceLocation Loc, NamedDecl *FDecl,
3337 StringRef ParamName, QualType ArgTy,
3338 QualType ParamTy) {
3339
3340 // If a function accepts a pointer or reference type
3341 if (!ParamTy->isPointerType() && !ParamTy->isReferenceType())
3342 return;
3343
3344 // If the parameter is a pointer type, get the pointee type for the
3345 // argument too. If the parameter is a reference type, don't try to get
3346 // the pointee type for the argument.
3347 if (ParamTy->isPointerType())
3348 ArgTy = ArgTy->getPointeeType();
3349
3350 // Remove reference or pointer
3351 ParamTy = ParamTy->getPointeeType();
3352
3353 // Find expected alignment, and the actual alignment of the passed object.
3354 // getTypeAlignInChars requires complete types
3355 if (ArgTy.isNull() || ParamTy->isDependentType() ||
3356 ParamTy->isIncompleteType() || ArgTy->isIncompleteType() ||
3357 ParamTy->isUndeducedType() || ArgTy->isUndeducedType())
3358 return;
3359
3360 CharUnits ParamAlign = Context.getTypeAlignInChars(T: ParamTy);
3361 CharUnits ArgAlign = Context.getTypeAlignInChars(T: ArgTy);
3362
3363 // If the argument is less aligned than the parameter, there is a
3364 // potential alignment issue.
3365 if (ArgAlign < ParamAlign)
3366 Diag(Loc, diag::warn_param_mismatched_alignment)
3367 << (int)ArgAlign.getQuantity() << (int)ParamAlign.getQuantity()
3368 << ParamName << (FDecl != nullptr) << FDecl;
3369}
3370
3371void Sema::checkLifetimeCaptureBy(FunctionDecl *FD, bool IsMemberFunction,
3372 const Expr *ThisArg,
3373 ArrayRef<const Expr *> Args) {
3374 if (!FD || Args.empty())
3375 return;
3376 auto GetArgAt = [&](int Idx) -> const Expr * {
3377 if (Idx == LifetimeCaptureByAttr::Global ||
3378 Idx == LifetimeCaptureByAttr::Unknown)
3379 return nullptr;
3380 if (IsMemberFunction && Idx == 0)
3381 return ThisArg;
3382 return Args[Idx - IsMemberFunction];
3383 };
3384 auto HandleCaptureByAttr = [&](const LifetimeCaptureByAttr *Attr,
3385 unsigned ArgIdx) {
3386 if (!Attr)
3387 return;
3388
3389 Expr *Captured = const_cast<Expr *>(GetArgAt(ArgIdx));
3390 for (int CapturingParamIdx : Attr->params()) {
3391 // lifetime_capture_by(this) case is handled in the lifetimebound expr
3392 // initialization codepath.
3393 if (CapturingParamIdx == LifetimeCaptureByAttr::This &&
3394 isa<CXXConstructorDecl>(FD))
3395 continue;
3396 Expr *Capturing = const_cast<Expr *>(GetArgAt(CapturingParamIdx));
3397 CapturingEntity CE{Capturing};
3398 // Ensure that 'Captured' outlives the 'Capturing' entity.
3399 checkCaptureByLifetime(*this, CE, Captured);
3400 }
3401 };
3402 for (unsigned I = 0; I < FD->getNumParams(); ++I)
3403 HandleCaptureByAttr(FD->getParamDecl(I)->getAttr<LifetimeCaptureByAttr>(),
3404 I + IsMemberFunction);
3405 // Check when the implicit object param is captured.
3406 if (IsMemberFunction) {
3407 TypeSourceInfo *TSI = FD->getTypeSourceInfo();
3408 if (!TSI)
3409 return;
3410 AttributedTypeLoc ATL;
3411 for (TypeLoc TL = TSI->getTypeLoc();
3412 (ATL = TL.getAsAdjusted<AttributedTypeLoc>());
3413 TL = ATL.getModifiedLoc())
3414 HandleCaptureByAttr(ATL.getAttrAs<LifetimeCaptureByAttr>(), 0);
3415 }
3416}
3417
3418void Sema::checkCall(NamedDecl *FDecl, const FunctionProtoType *Proto,
3419 const Expr *ThisArg, ArrayRef<const Expr *> Args,
3420 bool IsMemberFunction, SourceLocation Loc,
3421 SourceRange Range, VariadicCallType CallType) {
3422 // FIXME: We should check as much as we can in the template definition.
3423 if (CurContext->isDependentContext())
3424 return;
3425
3426 // Printf and scanf checking.
3427 llvm::SmallBitVector CheckedVarArgs;
3428 if (FDecl) {
3429 for (const auto *I : FDecl->specific_attrs<FormatMatchesAttr>()) {
3430 // Only create vector if there are format attributes.
3431 CheckedVarArgs.resize(Args.size());
3432 CheckFormatString(I, Args, IsMemberFunction, CallType, Loc, Range,
3433 CheckedVarArgs);
3434 }
3435
3436 for (const auto *I : FDecl->specific_attrs<FormatAttr>()) {
3437 CheckedVarArgs.resize(Args.size());
3438 CheckFormatArguments(I, Args, IsMemberFunction, CallType, Loc, Range,
3439 CheckedVarArgs);
3440 }
3441 }
3442
3443 // Refuse POD arguments that weren't caught by the format string
3444 // checks above.
3445 auto *FD = dyn_cast_or_null<FunctionDecl>(Val: FDecl);
3446 if (CallType != VariadicCallType::DoesNotApply &&
3447 (!FD || FD->getBuiltinID() != Builtin::BI__noop)) {
3448 unsigned NumParams = Proto ? Proto->getNumParams()
3449 : isa_and_nonnull<FunctionDecl>(Val: FDecl)
3450 ? cast<FunctionDecl>(Val: FDecl)->getNumParams()
3451 : isa_and_nonnull<ObjCMethodDecl>(Val: FDecl)
3452 ? cast<ObjCMethodDecl>(Val: FDecl)->param_size()
3453 : 0;
3454
3455 for (unsigned ArgIdx = NumParams; ArgIdx < Args.size(); ++ArgIdx) {
3456 // Args[ArgIdx] can be null in malformed code.
3457 if (const Expr *Arg = Args[ArgIdx]) {
3458 if (CheckedVarArgs.empty() || !CheckedVarArgs[ArgIdx])
3459 checkVariadicArgument(E: Arg, CT: CallType);
3460 }
3461 }
3462 }
3463 if (FD)
3464 checkLifetimeCaptureBy(FD, IsMemberFunction, ThisArg, Args);
3465 if (FDecl || Proto) {
3466 CheckNonNullArguments(S&: *this, FDecl, Proto, Args, CallSiteLoc: Loc);
3467
3468 // Type safety checking.
3469 if (FDecl) {
3470 for (const auto *I : FDecl->specific_attrs<ArgumentWithTypeTagAttr>())
3471 CheckArgumentWithTypeTag(I, Args, Loc);
3472 }
3473 }
3474
3475 // Check that passed arguments match the alignment of original arguments.
3476 // Try to get the missing prototype from the declaration.
3477 if (!Proto && FDecl) {
3478 const auto *FT = FDecl->getFunctionType();
3479 if (isa_and_nonnull<FunctionProtoType>(FT))
3480 Proto = cast<FunctionProtoType>(FDecl->getFunctionType());
3481 }
3482 if (Proto) {
3483 // For variadic functions, we may have more args than parameters.
3484 // For some K&R functions, we may have less args than parameters.
3485 const auto N = std::min<unsigned>(a: Proto->getNumParams(), b: Args.size());
3486 bool IsScalableRet = Proto->getReturnType()->isSizelessVectorType();
3487 bool IsScalableArg = false;
3488 for (unsigned ArgIdx = 0; ArgIdx < N; ++ArgIdx) {
3489 // Args[ArgIdx] can be null in malformed code.
3490 if (const Expr *Arg = Args[ArgIdx]) {
3491 if (Arg->containsErrors())
3492 continue;
3493
3494 if (Context.getTargetInfo().getTriple().isOSAIX() && FDecl && Arg &&
3495 FDecl->hasLinkage() &&
3496 FDecl->getFormalLinkage() != Linkage::Internal &&
3497 CallType == VariadicCallType::DoesNotApply)
3498 PPC().checkAIXMemberAlignment(Loc: (Arg->getExprLoc()), Arg);
3499
3500 QualType ParamTy = Proto->getParamType(i: ArgIdx);
3501 if (ParamTy->isSizelessVectorType())
3502 IsScalableArg = true;
3503 QualType ArgTy = Arg->getType();
3504 CheckArgAlignment(Loc: Arg->getExprLoc(), FDecl, ParamName: std::to_string(val: ArgIdx + 1),
3505 ArgTy, ParamTy);
3506 }
3507 }
3508
3509 // If the callee has an AArch64 SME attribute to indicate that it is an
3510 // __arm_streaming function, then the caller requires SME to be available.
3511 FunctionProtoType::ExtProtoInfo ExtInfo = Proto->getExtProtoInfo();
3512 if (ExtInfo.AArch64SMEAttributes & FunctionType::SME_PStateSMEnabledMask) {
3513 if (auto *CallerFD = dyn_cast<FunctionDecl>(Val: CurContext)) {
3514 llvm::StringMap<bool> CallerFeatureMap;
3515 Context.getFunctionFeatureMap(CallerFeatureMap, CallerFD);
3516 if (!CallerFeatureMap.contains("sme"))
3517 Diag(Loc, diag::err_sme_call_in_non_sme_target);
3518 } else if (!Context.getTargetInfo().hasFeature(Feature: "sme")) {
3519 Diag(Loc, diag::err_sme_call_in_non_sme_target);
3520 }
3521 }
3522
3523 // If the call requires a streaming-mode change and has scalable vector
3524 // arguments or return values, then warn the user that the streaming and
3525 // non-streaming vector lengths may be different.
3526 const auto *CallerFD = dyn_cast<FunctionDecl>(Val: CurContext);
3527 if (CallerFD && (!FD || !FD->getBuiltinID()) &&
3528 (IsScalableArg || IsScalableRet)) {
3529 bool IsCalleeStreaming =
3530 ExtInfo.AArch64SMEAttributes & FunctionType::SME_PStateSMEnabledMask;
3531 bool IsCalleeStreamingCompatible =
3532 ExtInfo.AArch64SMEAttributes &
3533 FunctionType::SME_PStateSMCompatibleMask;
3534 SemaARM::ArmStreamingType CallerFnType = getArmStreamingFnType(FD: CallerFD);
3535 if (!IsCalleeStreamingCompatible &&
3536 (CallerFnType == SemaARM::ArmStreamingCompatible ||
3537 ((CallerFnType == SemaARM::ArmStreaming) ^ IsCalleeStreaming))) {
3538 if (IsScalableArg)
3539 Diag(Loc, diag::warn_sme_streaming_pass_return_vl_to_non_streaming)
3540 << /*IsArg=*/true;
3541 if (IsScalableRet)
3542 Diag(Loc, diag::warn_sme_streaming_pass_return_vl_to_non_streaming)
3543 << /*IsArg=*/false;
3544 }
3545 }
3546
3547 FunctionType::ArmStateValue CalleeArmZAState =
3548 FunctionType::getArmZAState(AttrBits: ExtInfo.AArch64SMEAttributes);
3549 FunctionType::ArmStateValue CalleeArmZT0State =
3550 FunctionType::getArmZT0State(AttrBits: ExtInfo.AArch64SMEAttributes);
3551 if (CalleeArmZAState != FunctionType::ARM_None ||
3552 CalleeArmZT0State != FunctionType::ARM_None) {
3553 bool CallerHasZAState = false;
3554 bool CallerHasZT0State = false;
3555 if (CallerFD) {
3556 auto *Attr = CallerFD->getAttr<ArmNewAttr>();
3557 if (Attr && Attr->isNewZA())
3558 CallerHasZAState = true;
3559 if (Attr && Attr->isNewZT0())
3560 CallerHasZT0State = true;
3561 if (const auto *FPT = CallerFD->getType()->getAs<FunctionProtoType>()) {
3562 CallerHasZAState |=
3563 FunctionType::getArmZAState(
3564 AttrBits: FPT->getExtProtoInfo().AArch64SMEAttributes) !=
3565 FunctionType::ARM_None;
3566 CallerHasZT0State |=
3567 FunctionType::getArmZT0State(
3568 AttrBits: FPT->getExtProtoInfo().AArch64SMEAttributes) !=
3569 FunctionType::ARM_None;
3570 }
3571 }
3572
3573 if (CalleeArmZAState != FunctionType::ARM_None && !CallerHasZAState)
3574 Diag(Loc, diag::err_sme_za_call_no_za_state);
3575
3576 if (CalleeArmZT0State != FunctionType::ARM_None && !CallerHasZT0State)
3577 Diag(Loc, diag::err_sme_zt0_call_no_zt0_state);
3578
3579 if (CallerHasZAState && CalleeArmZAState == FunctionType::ARM_None &&
3580 CalleeArmZT0State != FunctionType::ARM_None) {
3581 Diag(Loc, diag::err_sme_unimplemented_za_save_restore);
3582 Diag(Loc, diag::note_sme_use_preserves_za);
3583 }
3584 }
3585 }
3586
3587 if (FDecl && FDecl->hasAttr<AllocAlignAttr>()) {
3588 auto *AA = FDecl->getAttr<AllocAlignAttr>();
3589 const Expr *Arg = Args[AA->getParamIndex().getASTIndex()];
3590 if (!Arg->isValueDependent()) {
3591 Expr::EvalResult Align;
3592 if (Arg->EvaluateAsInt(Result&: Align, Ctx: Context)) {
3593 const llvm::APSInt &I = Align.Val.getInt();
3594 if (!I.isPowerOf2())
3595 Diag(Arg->getExprLoc(), diag::warn_alignment_not_power_of_two)
3596 << Arg->getSourceRange();
3597
3598 if (I > Sema::MaximumAlignment)
3599 Diag(Arg->getExprLoc(), diag::warn_assume_aligned_too_great)
3600 << Arg->getSourceRange() << Sema::MaximumAlignment;
3601 }
3602 }
3603 }
3604
3605 if (FD)
3606 diagnoseArgDependentDiagnoseIfAttrs(Function: FD, ThisArg, Args, Loc);
3607}
3608
3609void Sema::CheckConstrainedAuto(const AutoType *AutoT, SourceLocation Loc) {
3610 if (ConceptDecl *Decl = AutoT->getTypeConstraintConcept()) {
3611 DiagnoseUseOfDecl(Decl, Loc);
3612 }
3613}
3614
3615void Sema::CheckConstructorCall(FunctionDecl *FDecl, QualType ThisType,
3616 ArrayRef<const Expr *> Args,
3617 const FunctionProtoType *Proto,
3618 SourceLocation Loc) {
3619 VariadicCallType CallType = Proto->isVariadic()
3620 ? VariadicCallType::Constructor
3621 : VariadicCallType::DoesNotApply;
3622
3623 auto *Ctor = cast<CXXConstructorDecl>(Val: FDecl);
3624 CheckArgAlignment(
3625 Loc, FDecl, ParamName: "'this'", ArgTy: Context.getPointerType(T: ThisType),
3626 ParamTy: Context.getPointerType(Ctor->getFunctionObjectParameterType()));
3627
3628 checkCall(FDecl, Proto, /*ThisArg=*/nullptr, Args, /*IsMemberFunction=*/true,
3629 Loc, SourceRange(), CallType);
3630}
3631
3632bool Sema::CheckFunctionCall(FunctionDecl *FDecl, CallExpr *TheCall,
3633 const FunctionProtoType *Proto) {
3634 bool IsMemberOperatorCall = isa<CXXOperatorCallExpr>(Val: TheCall) &&
3635 isa<CXXMethodDecl>(Val: FDecl);
3636 bool IsMemberFunction = isa<CXXMemberCallExpr>(Val: TheCall) ||
3637 IsMemberOperatorCall;
3638 VariadicCallType CallType = getVariadicCallType(FDecl, Proto,
3639 Fn: TheCall->getCallee());
3640 Expr** Args = TheCall->getArgs();
3641 unsigned NumArgs = TheCall->getNumArgs();
3642
3643 Expr *ImplicitThis = nullptr;
3644 if (IsMemberOperatorCall && !FDecl->hasCXXExplicitFunctionObjectParameter()) {
3645 // If this is a call to a member operator, hide the first
3646 // argument from checkCall.
3647 // FIXME: Our choice of AST representation here is less than ideal.
3648 ImplicitThis = Args[0];
3649 ++Args;
3650 --NumArgs;
3651 } else if (IsMemberFunction && !FDecl->isStatic() &&
3652 !FDecl->hasCXXExplicitFunctionObjectParameter())
3653 ImplicitThis =
3654 cast<CXXMemberCallExpr>(Val: TheCall)->getImplicitObjectArgument();
3655
3656 if (ImplicitThis) {
3657 // ImplicitThis may or may not be a pointer, depending on whether . or -> is
3658 // used.
3659 QualType ThisType = ImplicitThis->getType();
3660 if (!ThisType->isPointerType()) {
3661 assert(!ThisType->isReferenceType());
3662 ThisType = Context.getPointerType(T: ThisType);
3663 }
3664
3665 QualType ThisTypeFromDecl = Context.getPointerType(
3666 T: cast<CXXMethodDecl>(Val: FDecl)->getFunctionObjectParameterType());
3667
3668 CheckArgAlignment(TheCall->getRParenLoc(), FDecl, "'this'", ThisType,
3669 ThisTypeFromDecl);
3670 }
3671
3672 checkCall(FDecl, Proto, ThisArg: ImplicitThis, Args: llvm::ArrayRef(Args, NumArgs),
3673 IsMemberFunction, Loc: TheCall->getRParenLoc(),
3674 Range: TheCall->getCallee()->getSourceRange(), CallType);
3675
3676 IdentifierInfo *FnInfo = FDecl->getIdentifier();
3677 // None of the checks below are needed for functions that don't have
3678 // simple names (e.g., C++ conversion functions).
3679 if (!FnInfo)
3680 return false;
3681
3682 // Enforce TCB except for builtin calls, which are always allowed.
3683 if (FDecl->getBuiltinID() == 0)
3684 CheckTCBEnforcement(CallExprLoc: TheCall->getExprLoc(), Callee: FDecl);
3685
3686 CheckAbsoluteValueFunction(Call: TheCall, FDecl);
3687 CheckMaxUnsignedZero(Call: TheCall, FDecl);
3688 CheckInfNaNFunction(Call: TheCall, FDecl);
3689
3690 if (getLangOpts().ObjC)
3691 ObjC().DiagnoseCStringFormatDirectiveInCFAPI(FDecl, Args, NumArgs);
3692
3693 unsigned CMId = FDecl->getMemoryFunctionKind();
3694
3695 // Handle memory setting and copying functions.
3696 switch (CMId) {
3697 case 0:
3698 return false;
3699 case Builtin::BIstrlcpy: // fallthrough
3700 case Builtin::BIstrlcat:
3701 CheckStrlcpycatArguments(Call: TheCall, FnName: FnInfo);
3702 break;
3703 case Builtin::BIstrncat:
3704 CheckStrncatArguments(Call: TheCall, FnName: FnInfo);
3705 break;
3706 case Builtin::BIfree:
3707 CheckFreeArguments(E: TheCall);
3708 break;
3709 default:
3710 CheckMemaccessArguments(Call: TheCall, BId: CMId, FnName: FnInfo);
3711 }
3712
3713 return false;
3714}
3715
3716bool Sema::CheckPointerCall(NamedDecl *NDecl, CallExpr *TheCall,
3717 const FunctionProtoType *Proto) {
3718 QualType Ty;
3719 if (const auto *V = dyn_cast<VarDecl>(Val: NDecl))
3720 Ty = V->getType().getNonReferenceType();
3721 else if (const auto *F = dyn_cast<FieldDecl>(Val: NDecl))
3722 Ty = F->getType().getNonReferenceType();
3723 else
3724 return false;
3725
3726 if (!Ty->isBlockPointerType() && !Ty->isFunctionPointerType() &&
3727 !Ty->isFunctionProtoType())
3728 return false;
3729
3730 VariadicCallType CallType;
3731 if (!Proto || !Proto->isVariadic()) {
3732 CallType = VariadicCallType::DoesNotApply;
3733 } else if (Ty->isBlockPointerType()) {
3734 CallType = VariadicCallType::Block;
3735 } else { // Ty->isFunctionPointerType()
3736 CallType = VariadicCallType::Function;
3737 }
3738
3739 checkCall(FDecl: NDecl, Proto, /*ThisArg=*/nullptr,
3740 Args: llvm::ArrayRef(TheCall->getArgs(), TheCall->getNumArgs()),
3741 /*IsMemberFunction=*/false, Loc: TheCall->getRParenLoc(),
3742 Range: TheCall->getCallee()->getSourceRange(), CallType);
3743
3744 return false;
3745}
3746
3747bool Sema::CheckOtherCall(CallExpr *TheCall, const FunctionProtoType *Proto) {
3748 VariadicCallType CallType = getVariadicCallType(/*FDecl=*/nullptr, Proto,
3749 Fn: TheCall->getCallee());
3750 checkCall(/*FDecl=*/nullptr, Proto, /*ThisArg=*/nullptr,
3751 Args: llvm::ArrayRef(TheCall->getArgs(), TheCall->getNumArgs()),
3752 /*IsMemberFunction=*/false, Loc: TheCall->getRParenLoc(),
3753 Range: TheCall->getCallee()->getSourceRange(), CallType);
3754
3755 return false;
3756}
3757
3758static bool isValidOrderingForOp(int64_t Ordering, AtomicExpr::AtomicOp Op) {
3759 if (!llvm::isValidAtomicOrderingCABI(I: Ordering))
3760 return false;
3761
3762 auto OrderingCABI = (llvm::AtomicOrderingCABI)Ordering;
3763 switch (Op) {
3764 case AtomicExpr::AO__c11_atomic_init:
3765 case AtomicExpr::AO__opencl_atomic_init:
3766 llvm_unreachable("There is no ordering argument for an init");
3767
3768 case AtomicExpr::AO__c11_atomic_load:
3769 case AtomicExpr::AO__opencl_atomic_load:
3770 case AtomicExpr::AO__hip_atomic_load:
3771 case AtomicExpr::AO__atomic_load_n:
3772 case AtomicExpr::AO__atomic_load:
3773 case AtomicExpr::AO__scoped_atomic_load_n:
3774 case AtomicExpr::AO__scoped_atomic_load:
3775 return OrderingCABI != llvm::AtomicOrderingCABI::release &&
3776 OrderingCABI != llvm::AtomicOrderingCABI::acq_rel;
3777
3778 case AtomicExpr::AO__c11_atomic_store:
3779 case AtomicExpr::AO__opencl_atomic_store:
3780 case AtomicExpr::AO__hip_atomic_store:
3781 case AtomicExpr::AO__atomic_store:
3782 case AtomicExpr::AO__atomic_store_n:
3783 case AtomicExpr::AO__scoped_atomic_store:
3784 case AtomicExpr::AO__scoped_atomic_store_n:
3785 case AtomicExpr::AO__atomic_clear:
3786 return OrderingCABI != llvm::AtomicOrderingCABI::consume &&
3787 OrderingCABI != llvm::AtomicOrderingCABI::acquire &&
3788 OrderingCABI != llvm::AtomicOrderingCABI::acq_rel;
3789
3790 default:
3791 return true;
3792 }
3793}
3794
3795ExprResult Sema::AtomicOpsOverloaded(ExprResult TheCallResult,
3796 AtomicExpr::AtomicOp Op) {
3797 CallExpr *TheCall = cast<CallExpr>(Val: TheCallResult.get());
3798 DeclRefExpr *DRE =cast<DeclRefExpr>(Val: TheCall->getCallee()->IgnoreParenCasts());
3799 MultiExprArg Args{TheCall->getArgs(), TheCall->getNumArgs()};
3800 return BuildAtomicExpr(CallRange: {TheCall->getBeginLoc(), TheCall->getEndLoc()},
3801 ExprRange: DRE->getSourceRange(), RParenLoc: TheCall->getRParenLoc(), Args,
3802 Op);
3803}
3804
3805ExprResult Sema::BuildAtomicExpr(SourceRange CallRange, SourceRange ExprRange,
3806 SourceLocation RParenLoc, MultiExprArg Args,
3807 AtomicExpr::AtomicOp Op,
3808 AtomicArgumentOrder ArgOrder) {
3809 // All the non-OpenCL operations take one of the following forms.
3810 // The OpenCL operations take the __c11 forms with one extra argument for
3811 // synchronization scope.
3812 enum {
3813 // C __c11_atomic_init(A *, C)
3814 Init,
3815
3816 // C __c11_atomic_load(A *, int)
3817 Load,
3818
3819 // void __atomic_load(A *, CP, int)
3820 LoadCopy,
3821
3822 // void __atomic_store(A *, CP, int)
3823 Copy,
3824
3825 // C __c11_atomic_add(A *, M, int)
3826 Arithmetic,
3827
3828 // C __atomic_exchange_n(A *, CP, int)
3829 Xchg,
3830
3831 // void __atomic_exchange(A *, C *, CP, int)
3832 GNUXchg,
3833
3834 // bool __c11_atomic_compare_exchange_strong(A *, C *, CP, int, int)
3835 C11CmpXchg,
3836
3837 // bool __atomic_compare_exchange(A *, C *, CP, bool, int, int)
3838 GNUCmpXchg,
3839
3840 // bool __atomic_test_and_set(A *, int)
3841 TestAndSetByte,
3842
3843 // void __atomic_clear(A *, int)
3844 ClearByte,
3845 } Form = Init;
3846
3847 const unsigned NumForm = ClearByte + 1;
3848 const unsigned NumArgs[] = {2, 2, 3, 3, 3, 3, 4, 5, 6, 2, 2};
3849 const unsigned NumVals[] = {1, 0, 1, 1, 1, 1, 2, 2, 3, 0, 0};
3850 // where:
3851 // C is an appropriate type,
3852 // A is volatile _Atomic(C) for __c11 builtins and is C for GNU builtins,
3853 // CP is C for __c11 builtins and GNU _n builtins and is C * otherwise,
3854 // M is C if C is an integer, and ptrdiff_t if C is a pointer, and
3855 // the int parameters are for orderings.
3856
3857 static_assert(sizeof(NumArgs)/sizeof(NumArgs[0]) == NumForm
3858 && sizeof(NumVals)/sizeof(NumVals[0]) == NumForm,
3859 "need to update code for modified forms");
3860 static_assert(AtomicExpr::AO__atomic_add_fetch == 0 &&
3861 AtomicExpr::AO__atomic_xor_fetch + 1 ==
3862 AtomicExpr::AO__c11_atomic_compare_exchange_strong,
3863 "need to update code for modified C11 atomics");
3864 bool IsOpenCL = Op >= AtomicExpr::AO__opencl_atomic_compare_exchange_strong &&
3865 Op <= AtomicExpr::AO__opencl_atomic_store;
3866 bool IsHIP = Op >= AtomicExpr::AO__hip_atomic_compare_exchange_strong &&
3867 Op <= AtomicExpr::AO__hip_atomic_store;
3868 bool IsScoped = Op >= AtomicExpr::AO__scoped_atomic_add_fetch &&
3869 Op <= AtomicExpr::AO__scoped_atomic_xor_fetch;
3870 bool IsC11 = (Op >= AtomicExpr::AO__c11_atomic_compare_exchange_strong &&
3871 Op <= AtomicExpr::AO__c11_atomic_store) ||
3872 IsOpenCL;
3873 bool IsN = Op == AtomicExpr::AO__atomic_load_n ||
3874 Op == AtomicExpr::AO__atomic_store_n ||
3875 Op == AtomicExpr::AO__atomic_exchange_n ||
3876 Op == AtomicExpr::AO__atomic_compare_exchange_n ||
3877 Op == AtomicExpr::AO__scoped_atomic_load_n ||
3878 Op == AtomicExpr::AO__scoped_atomic_store_n ||
3879 Op == AtomicExpr::AO__scoped_atomic_exchange_n ||
3880 Op == AtomicExpr::AO__scoped_atomic_compare_exchange_n;
3881 // Bit mask for extra allowed value types other than integers for atomic
3882 // arithmetic operations. Add/sub allow pointer and floating point. Min/max
3883 // allow floating point.
3884 enum ArithOpExtraValueType {
3885 AOEVT_None = 0,
3886 AOEVT_Pointer = 1,
3887 AOEVT_FP = 2,
3888 };
3889 unsigned ArithAllows = AOEVT_None;
3890
3891 switch (Op) {
3892 case AtomicExpr::AO__c11_atomic_init:
3893 case AtomicExpr::AO__opencl_atomic_init:
3894 Form = Init;
3895 break;
3896
3897 case AtomicExpr::AO__c11_atomic_load:
3898 case AtomicExpr::AO__opencl_atomic_load:
3899 case AtomicExpr::AO__hip_atomic_load:
3900 case AtomicExpr::AO__atomic_load_n:
3901 case AtomicExpr::AO__scoped_atomic_load_n:
3902 Form = Load;
3903 break;
3904
3905 case AtomicExpr::AO__atomic_load:
3906 case AtomicExpr::AO__scoped_atomic_load:
3907 Form = LoadCopy;
3908 break;
3909
3910 case AtomicExpr::AO__c11_atomic_store:
3911 case AtomicExpr::AO__opencl_atomic_store:
3912 case AtomicExpr::AO__hip_atomic_store:
3913 case AtomicExpr::AO__atomic_store:
3914 case AtomicExpr::AO__atomic_store_n:
3915 case AtomicExpr::AO__scoped_atomic_store:
3916 case AtomicExpr::AO__scoped_atomic_store_n:
3917 Form = Copy;
3918 break;
3919 case AtomicExpr::AO__atomic_fetch_add:
3920 case AtomicExpr::AO__atomic_fetch_sub:
3921 case AtomicExpr::AO__atomic_add_fetch:
3922 case AtomicExpr::AO__atomic_sub_fetch:
3923 case AtomicExpr::AO__scoped_atomic_fetch_add:
3924 case AtomicExpr::AO__scoped_atomic_fetch_sub:
3925 case AtomicExpr::AO__scoped_atomic_add_fetch:
3926 case AtomicExpr::AO__scoped_atomic_sub_fetch:
3927 case AtomicExpr::AO__c11_atomic_fetch_add:
3928 case AtomicExpr::AO__c11_atomic_fetch_sub:
3929 case AtomicExpr::AO__opencl_atomic_fetch_add:
3930 case AtomicExpr::AO__opencl_atomic_fetch_sub:
3931 case AtomicExpr::AO__hip_atomic_fetch_add:
3932 case AtomicExpr::AO__hip_atomic_fetch_sub:
3933 ArithAllows = AOEVT_Pointer | AOEVT_FP;
3934 Form = Arithmetic;
3935 break;
3936 case AtomicExpr::AO__atomic_fetch_max:
3937 case AtomicExpr::AO__atomic_fetch_min:
3938 case AtomicExpr::AO__atomic_max_fetch:
3939 case AtomicExpr::AO__atomic_min_fetch:
3940 case AtomicExpr::AO__scoped_atomic_fetch_max:
3941 case AtomicExpr::AO__scoped_atomic_fetch_min:
3942 case AtomicExpr::AO__scoped_atomic_max_fetch:
3943 case AtomicExpr::AO__scoped_atomic_min_fetch:
3944 case AtomicExpr::AO__c11_atomic_fetch_max:
3945 case AtomicExpr::AO__c11_atomic_fetch_min:
3946 case AtomicExpr::AO__opencl_atomic_fetch_max:
3947 case AtomicExpr::AO__opencl_atomic_fetch_min:
3948 case AtomicExpr::AO__hip_atomic_fetch_max:
3949 case AtomicExpr::AO__hip_atomic_fetch_min:
3950 ArithAllows = AOEVT_FP;
3951 Form = Arithmetic;
3952 break;
3953 case AtomicExpr::AO__c11_atomic_fetch_and:
3954 case AtomicExpr::AO__c11_atomic_fetch_or:
3955 case AtomicExpr::AO__c11_atomic_fetch_xor:
3956 case AtomicExpr::AO__hip_atomic_fetch_and:
3957 case AtomicExpr::AO__hip_atomic_fetch_or:
3958 case AtomicExpr::AO__hip_atomic_fetch_xor:
3959 case AtomicExpr::AO__c11_atomic_fetch_nand:
3960 case AtomicExpr::AO__opencl_atomic_fetch_and:
3961 case AtomicExpr::AO__opencl_atomic_fetch_or:
3962 case AtomicExpr::AO__opencl_atomic_fetch_xor:
3963 case AtomicExpr::AO__atomic_fetch_and:
3964 case AtomicExpr::AO__atomic_fetch_or:
3965 case AtomicExpr::AO__atomic_fetch_xor:
3966 case AtomicExpr::AO__atomic_fetch_nand:
3967 case AtomicExpr::AO__atomic_and_fetch:
3968 case AtomicExpr::AO__atomic_or_fetch:
3969 case AtomicExpr::AO__atomic_xor_fetch:
3970 case AtomicExpr::AO__atomic_nand_fetch:
3971 case AtomicExpr::AO__scoped_atomic_fetch_and:
3972 case AtomicExpr::AO__scoped_atomic_fetch_or:
3973 case AtomicExpr::AO__scoped_atomic_fetch_xor:
3974 case AtomicExpr::AO__scoped_atomic_fetch_nand:
3975 case AtomicExpr::AO__scoped_atomic_and_fetch:
3976 case AtomicExpr::AO__scoped_atomic_or_fetch:
3977 case AtomicExpr::AO__scoped_atomic_xor_fetch:
3978 case AtomicExpr::AO__scoped_atomic_nand_fetch:
3979 Form = Arithmetic;
3980 break;
3981
3982 case AtomicExpr::AO__c11_atomic_exchange:
3983 case AtomicExpr::AO__hip_atomic_exchange:
3984 case AtomicExpr::AO__opencl_atomic_exchange:
3985 case AtomicExpr::AO__atomic_exchange_n:
3986 case AtomicExpr::AO__scoped_atomic_exchange_n:
3987 Form = Xchg;
3988 break;
3989
3990 case AtomicExpr::AO__atomic_exchange:
3991 case AtomicExpr::AO__scoped_atomic_exchange:
3992 Form = GNUXchg;
3993 break;
3994
3995 case AtomicExpr::AO__c11_atomic_compare_exchange_strong:
3996 case AtomicExpr::AO__c11_atomic_compare_exchange_weak:
3997 case AtomicExpr::AO__hip_atomic_compare_exchange_strong:
3998 case AtomicExpr::AO__opencl_atomic_compare_exchange_strong:
3999 case AtomicExpr::AO__opencl_atomic_compare_exchange_weak:
4000 case AtomicExpr::AO__hip_atomic_compare_exchange_weak:
4001 Form = C11CmpXchg;
4002 break;
4003
4004 case AtomicExpr::AO__atomic_compare_exchange:
4005 case AtomicExpr::AO__atomic_compare_exchange_n:
4006 case AtomicExpr::AO__scoped_atomic_compare_exchange:
4007 case AtomicExpr::AO__scoped_atomic_compare_exchange_n:
4008 Form = GNUCmpXchg;
4009 break;
4010
4011 case AtomicExpr::AO__atomic_test_and_set:
4012 Form = TestAndSetByte;
4013 break;
4014
4015 case AtomicExpr::AO__atomic_clear:
4016 Form = ClearByte;
4017 break;
4018 }
4019
4020 unsigned AdjustedNumArgs = NumArgs[Form];
4021 if ((IsOpenCL || IsHIP || IsScoped) &&
4022 Op != AtomicExpr::AO__opencl_atomic_init)
4023 ++AdjustedNumArgs;
4024 // Check we have the right number of arguments.
4025 if (Args.size() < AdjustedNumArgs) {
4026 Diag(CallRange.getEnd(), diag::err_typecheck_call_too_few_args)
4027 << 0 << AdjustedNumArgs << static_cast<unsigned>(Args.size())
4028 << /*is non object*/ 0 << ExprRange;
4029 return ExprError();
4030 } else if (Args.size() > AdjustedNumArgs) {
4031 Diag(Args[AdjustedNumArgs]->getBeginLoc(),
4032 diag::err_typecheck_call_too_many_args)
4033 << 0 << AdjustedNumArgs << static_cast<unsigned>(Args.size())
4034 << /*is non object*/ 0 << ExprRange;
4035 return ExprError();
4036 }
4037
4038 // Inspect the first argument of the atomic operation.
4039 Expr *Ptr = Args[0];
4040 ExprResult ConvertedPtr = DefaultFunctionArrayLvalueConversion(E: Ptr);
4041 if (ConvertedPtr.isInvalid())
4042 return ExprError();
4043
4044 Ptr = ConvertedPtr.get();
4045 const PointerType *pointerType = Ptr->getType()->getAs<PointerType>();
4046 if (!pointerType) {
4047 Diag(ExprRange.getBegin(), diag::err_atomic_builtin_must_be_pointer)
4048 << Ptr->getType() << 0 << Ptr->getSourceRange();
4049 return ExprError();
4050 }
4051
4052 // For a __c11 builtin, this should be a pointer to an _Atomic type.
4053 QualType AtomTy = pointerType->getPointeeType(); // 'A'
4054 QualType ValType = AtomTy; // 'C'
4055 if (IsC11) {
4056 if (!AtomTy->isAtomicType()) {
4057 Diag(ExprRange.getBegin(), diag::err_atomic_op_needs_atomic)
4058 << Ptr->getType() << Ptr->getSourceRange();
4059 return ExprError();
4060 }
4061 if ((Form != Load && Form != LoadCopy && AtomTy.isConstQualified()) ||
4062 AtomTy.getAddressSpace() == LangAS::opencl_constant) {
4063 Diag(ExprRange.getBegin(), diag::err_atomic_op_needs_non_const_atomic)
4064 << (AtomTy.isConstQualified() ? 0 : 1) << Ptr->getType()
4065 << Ptr->getSourceRange();
4066 return ExprError();
4067 }
4068 ValType = AtomTy->castAs<AtomicType>()->getValueType();
4069 } else if (Form != Load && Form != LoadCopy) {
4070 if (ValType.isConstQualified()) {
4071 Diag(ExprRange.getBegin(), diag::err_atomic_op_needs_non_const_pointer)
4072 << Ptr->getType() << Ptr->getSourceRange();
4073 return ExprError();
4074 }
4075 }
4076
4077 if (Form != TestAndSetByte && Form != ClearByte) {
4078 // Pointer to object of size zero is not allowed.
4079 if (RequireCompleteType(Ptr->getBeginLoc(), AtomTy,
4080 diag::err_incomplete_type))
4081 return ExprError();
4082
4083 if (Context.getTypeInfoInChars(T: AtomTy).Width.isZero()) {
4084 Diag(ExprRange.getBegin(), diag::err_atomic_builtin_must_be_pointer)
4085 << Ptr->getType() << 1 << Ptr->getSourceRange();
4086 return ExprError();
4087 }
4088 } else {
4089 // The __atomic_clear and __atomic_test_and_set intrinsics accept any
4090 // non-const pointer type, including void* and pointers to incomplete
4091 // structs, but only access the first byte.
4092 AtomTy = Context.CharTy;
4093 AtomTy = AtomTy.withCVRQualifiers(
4094 CVR: pointerType->getPointeeType().getCVRQualifiers());
4095 QualType PointerQT = Context.getPointerType(T: AtomTy);
4096 pointerType = PointerQT->getAs<PointerType>();
4097 Ptr = ImpCastExprToType(E: Ptr, Type: PointerQT, CK: CK_BitCast).get();
4098 ValType = AtomTy;
4099 }
4100
4101 PointerAuthQualifier PointerAuth = AtomTy.getPointerAuth();
4102 if (PointerAuth && PointerAuth.isAddressDiscriminated()) {
4103 Diag(ExprRange.getBegin(),
4104 diag::err_atomic_op_needs_non_address_discriminated_pointer)
4105 << 0 << Ptr->getType() << Ptr->getSourceRange();
4106 return ExprError();
4107 }
4108
4109 // For an arithmetic operation, the implied arithmetic must be well-formed.
4110 if (Form == Arithmetic) {
4111 // GCC does not enforce these rules for GNU atomics, but we do to help catch
4112 // trivial type errors.
4113 auto IsAllowedValueType = [&](QualType ValType,
4114 unsigned AllowedType) -> bool {
4115 if (ValType->isIntegerType())
4116 return true;
4117 if (ValType->isPointerType())
4118 return AllowedType & AOEVT_Pointer;
4119 if (!(ValType->isFloatingType() && (AllowedType & AOEVT_FP)))
4120 return false;
4121 // LLVM Parser does not allow atomicrmw with x86_fp80 type.
4122 if (ValType->isSpecificBuiltinType(K: BuiltinType::LongDouble) &&
4123 &Context.getTargetInfo().getLongDoubleFormat() ==
4124 &llvm::APFloat::x87DoubleExtended())
4125 return false;
4126 return true;
4127 };
4128 if (!IsAllowedValueType(ValType, ArithAllows)) {
4129 auto DID = ArithAllows & AOEVT_FP
4130 ? (ArithAllows & AOEVT_Pointer
4131 ? diag::err_atomic_op_needs_atomic_int_ptr_or_fp
4132 : diag::err_atomic_op_needs_atomic_int_or_fp)
4133 : diag::err_atomic_op_needs_atomic_int;
4134 Diag(ExprRange.getBegin(), DID)
4135 << IsC11 << Ptr->getType() << Ptr->getSourceRange();
4136 return ExprError();
4137 }
4138 if (IsC11 && ValType->isPointerType() &&
4139 RequireCompleteType(Ptr->getBeginLoc(), ValType->getPointeeType(),
4140 diag::err_incomplete_type)) {
4141 return ExprError();
4142 }
4143 } else if (IsN && !ValType->isIntegerType() && !ValType->isPointerType()) {
4144 // For __atomic_*_n operations, the value type must be a scalar integral or
4145 // pointer type which is 1, 2, 4, 8 or 16 bytes in length.
4146 Diag(ExprRange.getBegin(), diag::err_atomic_op_needs_atomic_int_or_ptr)
4147 << IsC11 << Ptr->getType() << Ptr->getSourceRange();
4148 return ExprError();
4149 }
4150
4151 if (!IsC11 && !AtomTy.isTriviallyCopyableType(Context) &&
4152 !AtomTy->isScalarType()) {
4153 // For GNU atomics, require a trivially-copyable type. This is not part of
4154 // the GNU atomics specification but we enforce it for consistency with
4155 // other atomics which generally all require a trivially-copyable type. This
4156 // is because atomics just copy bits.
4157 Diag(ExprRange.getBegin(), diag::err_atomic_op_needs_trivial_copy)
4158 << Ptr->getType() << Ptr->getSourceRange();
4159 return ExprError();
4160 }
4161
4162 switch (ValType.getObjCLifetime()) {
4163 case Qualifiers::OCL_None:
4164 case Qualifiers::OCL_ExplicitNone:
4165 // okay
4166 break;
4167
4168 case Qualifiers::OCL_Weak:
4169 case Qualifiers::OCL_Strong:
4170 case Qualifiers::OCL_Autoreleasing:
4171 // FIXME: Can this happen? By this point, ValType should be known
4172 // to be trivially copyable.
4173 Diag(ExprRange.getBegin(), diag::err_arc_atomic_ownership)
4174 << ValType << Ptr->getSourceRange();
4175 return ExprError();
4176 }
4177
4178 // All atomic operations have an overload which takes a pointer to a volatile
4179 // 'A'. We shouldn't let the volatile-ness of the pointee-type inject itself
4180 // into the result or the other operands. Similarly atomic_load takes a
4181 // pointer to a const 'A'.
4182 ValType.removeLocalVolatile();
4183 ValType.removeLocalConst();
4184 QualType ResultType = ValType;
4185 if (Form == Copy || Form == LoadCopy || Form == GNUXchg || Form == Init ||
4186 Form == ClearByte)
4187 ResultType = Context.VoidTy;
4188 else if (Form == C11CmpXchg || Form == GNUCmpXchg || Form == TestAndSetByte)
4189 ResultType = Context.BoolTy;
4190
4191 // The type of a parameter passed 'by value'. In the GNU atomics, such
4192 // arguments are actually passed as pointers.
4193 QualType ByValType = ValType; // 'CP'
4194 bool IsPassedByAddress = false;
4195 if (!IsC11 && !IsHIP && !IsN) {
4196 ByValType = Ptr->getType();
4197 IsPassedByAddress = true;
4198 }
4199
4200 SmallVector<Expr *, 5> APIOrderedArgs;
4201 if (ArgOrder == Sema::AtomicArgumentOrder::AST) {
4202 APIOrderedArgs.push_back(Elt: Args[0]);
4203 switch (Form) {
4204 case Init:
4205 case Load:
4206 APIOrderedArgs.push_back(Elt: Args[1]); // Val1/Order
4207 break;
4208 case LoadCopy:
4209 case Copy:
4210 case Arithmetic:
4211 case Xchg:
4212 APIOrderedArgs.push_back(Elt: Args[2]); // Val1
4213 APIOrderedArgs.push_back(Elt: Args[1]); // Order
4214 break;
4215 case GNUXchg:
4216 APIOrderedArgs.push_back(Elt: Args[2]); // Val1
4217 APIOrderedArgs.push_back(Elt: Args[3]); // Val2
4218 APIOrderedArgs.push_back(Elt: Args[1]); // Order
4219 break;
4220 case C11CmpXchg:
4221 APIOrderedArgs.push_back(Elt: Args[2]); // Val1
4222 APIOrderedArgs.push_back(Elt: Args[4]); // Val2
4223 APIOrderedArgs.push_back(Elt: Args[1]); // Order
4224 APIOrderedArgs.push_back(Elt: Args[3]); // OrderFail
4225 break;
4226 case GNUCmpXchg:
4227 APIOrderedArgs.push_back(Elt: Args[2]); // Val1
4228 APIOrderedArgs.push_back(Elt: Args[4]); // Val2
4229 APIOrderedArgs.push_back(Elt: Args[5]); // Weak
4230 APIOrderedArgs.push_back(Elt: Args[1]); // Order
4231 APIOrderedArgs.push_back(Elt: Args[3]); // OrderFail
4232 break;
4233 case TestAndSetByte:
4234 case ClearByte:
4235 APIOrderedArgs.push_back(Elt: Args[1]); // Order
4236 break;
4237 }
4238 } else
4239 APIOrderedArgs.append(in_start: Args.begin(), in_end: Args.end());
4240
4241 // The first argument's non-CV pointer type is used to deduce the type of
4242 // subsequent arguments, except for:
4243 // - weak flag (always converted to bool)
4244 // - memory order (always converted to int)
4245 // - scope (always converted to int)
4246 for (unsigned i = 0; i != APIOrderedArgs.size(); ++i) {
4247 QualType Ty;
4248 if (i < NumVals[Form] + 1) {
4249 switch (i) {
4250 case 0:
4251 // The first argument is always a pointer. It has a fixed type.
4252 // It is always dereferenced, a nullptr is undefined.
4253 CheckNonNullArgument(S&: *this, ArgExpr: APIOrderedArgs[i], CallSiteLoc: ExprRange.getBegin());
4254 // Nothing else to do: we already know all we want about this pointer.
4255 continue;
4256 case 1:
4257 // The second argument is the non-atomic operand. For arithmetic, this
4258 // is always passed by value, and for a compare_exchange it is always
4259 // passed by address. For the rest, GNU uses by-address and C11 uses
4260 // by-value.
4261 assert(Form != Load);
4262 if (Form == Arithmetic && ValType->isPointerType())
4263 Ty = Context.getPointerDiffType();
4264 else if (Form == Init || Form == Arithmetic)
4265 Ty = ValType;
4266 else if (Form == Copy || Form == Xchg) {
4267 if (IsPassedByAddress) {
4268 // The value pointer is always dereferenced, a nullptr is undefined.
4269 CheckNonNullArgument(S&: *this, ArgExpr: APIOrderedArgs[i],
4270 CallSiteLoc: ExprRange.getBegin());
4271 }
4272 Ty = ByValType;
4273 } else {
4274 Expr *ValArg = APIOrderedArgs[i];
4275 // The value pointer is always dereferenced, a nullptr is undefined.
4276 CheckNonNullArgument(S&: *this, ArgExpr: ValArg, CallSiteLoc: ExprRange.getBegin());
4277 LangAS AS = LangAS::Default;
4278 // Keep address space of non-atomic pointer type.
4279 if (const PointerType *PtrTy =
4280 ValArg->getType()->getAs<PointerType>()) {
4281 AS = PtrTy->getPointeeType().getAddressSpace();
4282 }
4283 Ty = Context.getPointerType(
4284 T: Context.getAddrSpaceQualType(T: ValType.getUnqualifiedType(), AddressSpace: AS));
4285 }
4286 break;
4287 case 2:
4288 // The third argument to compare_exchange / GNU exchange is the desired
4289 // value, either by-value (for the C11 and *_n variant) or as a pointer.
4290 if (IsPassedByAddress)
4291 CheckNonNullArgument(S&: *this, ArgExpr: APIOrderedArgs[i], CallSiteLoc: ExprRange.getBegin());
4292 Ty = ByValType;
4293 break;
4294 case 3:
4295 // The fourth argument to GNU compare_exchange is a 'weak' flag.
4296 Ty = Context.BoolTy;
4297 break;
4298 }
4299 } else {
4300 // The order(s) and scope are always converted to int.
4301 Ty = Context.IntTy;
4302 }
4303
4304 InitializedEntity Entity =
4305 InitializedEntity::InitializeParameter(Context, Type: Ty, Consumed: false);
4306 ExprResult Arg = APIOrderedArgs[i];
4307 Arg = PerformCopyInitialization(Entity, EqualLoc: SourceLocation(), Init: Arg);
4308 if (Arg.isInvalid())
4309 return true;
4310 APIOrderedArgs[i] = Arg.get();
4311 }
4312
4313 // Permute the arguments into a 'consistent' order.
4314 SmallVector<Expr*, 5> SubExprs;
4315 SubExprs.push_back(Elt: Ptr);
4316 switch (Form) {
4317 case Init:
4318 // Note, AtomicExpr::getVal1() has a special case for this atomic.
4319 SubExprs.push_back(Elt: APIOrderedArgs[1]); // Val1
4320 break;
4321 case Load:
4322 case TestAndSetByte:
4323 case ClearByte:
4324 SubExprs.push_back(Elt: APIOrderedArgs[1]); // Order
4325 break;
4326 case LoadCopy:
4327 case Copy:
4328 case Arithmetic:
4329 case Xchg:
4330 SubExprs.push_back(Elt: APIOrderedArgs[2]); // Order
4331 SubExprs.push_back(Elt: APIOrderedArgs[1]); // Val1
4332 break;
4333 case GNUXchg:
4334 // Note, AtomicExpr::getVal2() has a special case for this atomic.
4335 SubExprs.push_back(Elt: APIOrderedArgs[3]); // Order
4336 SubExprs.push_back(Elt: APIOrderedArgs[1]); // Val1
4337 SubExprs.push_back(Elt: APIOrderedArgs[2]); // Val2
4338 break;
4339 case C11CmpXchg:
4340 SubExprs.push_back(Elt: APIOrderedArgs[3]); // Order
4341 SubExprs.push_back(Elt: APIOrderedArgs[1]); // Val1
4342 SubExprs.push_back(Elt: APIOrderedArgs[4]); // OrderFail
4343 SubExprs.push_back(Elt: APIOrderedArgs[2]); // Val2
4344 break;
4345 case GNUCmpXchg:
4346 SubExprs.push_back(Elt: APIOrderedArgs[4]); // Order
4347 SubExprs.push_back(Elt: APIOrderedArgs[1]); // Val1
4348 SubExprs.push_back(Elt: APIOrderedArgs[5]); // OrderFail
4349 SubExprs.push_back(Elt: APIOrderedArgs[2]); // Val2
4350 SubExprs.push_back(Elt: APIOrderedArgs[3]); // Weak
4351 break;
4352 }
4353
4354 // If the memory orders are constants, check they are valid.
4355 if (SubExprs.size() >= 2 && Form != Init) {
4356 std::optional<llvm::APSInt> Success =
4357 SubExprs[1]->getIntegerConstantExpr(Ctx: Context);
4358 if (Success && !isValidOrderingForOp(Ordering: Success->getSExtValue(), Op)) {
4359 Diag(SubExprs[1]->getBeginLoc(),
4360 diag::warn_atomic_op_has_invalid_memory_order)
4361 << /*success=*/(Form == C11CmpXchg || Form == GNUCmpXchg)
4362 << SubExprs[1]->getSourceRange();
4363 }
4364 if (SubExprs.size() >= 5) {
4365 if (std::optional<llvm::APSInt> Failure =
4366 SubExprs[3]->getIntegerConstantExpr(Ctx: Context)) {
4367 if (!llvm::is_contained(
4368 Set: {llvm::AtomicOrderingCABI::relaxed,
4369 llvm::AtomicOrderingCABI::consume,
4370 llvm::AtomicOrderingCABI::acquire,
4371 llvm::AtomicOrderingCABI::seq_cst},
4372 Element: (llvm::AtomicOrderingCABI)Failure->getSExtValue())) {
4373 Diag(SubExprs[3]->getBeginLoc(),
4374 diag::warn_atomic_op_has_invalid_memory_order)
4375 << /*failure=*/2 << SubExprs[3]->getSourceRange();
4376 }
4377 }
4378 }
4379 }
4380
4381 if (auto ScopeModel = AtomicExpr::getScopeModel(Op)) {
4382 auto *Scope = Args[Args.size() - 1];
4383 if (std::optional<llvm::APSInt> Result =
4384 Scope->getIntegerConstantExpr(Ctx: Context)) {
4385 if (!ScopeModel->isValid(Result->getZExtValue()))
4386 Diag(Scope->getBeginLoc(), diag::err_atomic_op_has_invalid_sync_scope)
4387 << Scope->getSourceRange();
4388 }
4389 SubExprs.push_back(Elt: Scope);
4390 }
4391
4392 AtomicExpr *AE = new (Context)
4393 AtomicExpr(ExprRange.getBegin(), SubExprs, ResultType, Op, RParenLoc);
4394
4395 if ((Op == AtomicExpr::AO__c11_atomic_load ||
4396 Op == AtomicExpr::AO__c11_atomic_store ||
4397 Op == AtomicExpr::AO__opencl_atomic_load ||
4398 Op == AtomicExpr::AO__hip_atomic_load ||
4399 Op == AtomicExpr::AO__opencl_atomic_store ||
4400 Op == AtomicExpr::AO__hip_atomic_store) &&
4401 Context.AtomicUsesUnsupportedLibcall(AE))
4402 Diag(AE->getBeginLoc(), diag::err_atomic_load_store_uses_lib)
4403 << ((Op == AtomicExpr::AO__c11_atomic_load ||
4404 Op == AtomicExpr::AO__opencl_atomic_load ||
4405 Op == AtomicExpr::AO__hip_atomic_load)
4406 ? 0
4407 : 1);
4408
4409 if (ValType->isBitIntType()) {
4410 Diag(Ptr->getExprLoc(), diag::err_atomic_builtin_bit_int_prohibit);
4411 return ExprError();
4412 }
4413
4414 return AE;
4415}
4416
4417/// checkBuiltinArgument - Given a call to a builtin function, perform
4418/// normal type-checking on the given argument, updating the call in
4419/// place. This is useful when a builtin function requires custom
4420/// type-checking for some of its arguments but not necessarily all of
4421/// them.
4422///
4423/// Returns true on error.
4424static bool checkBuiltinArgument(Sema &S, CallExpr *E, unsigned ArgIndex) {
4425 FunctionDecl *Fn = E->getDirectCallee();
4426 assert(Fn && "builtin call without direct callee!");
4427
4428 ParmVarDecl *Param = Fn->getParamDecl(i: ArgIndex);
4429 InitializedEntity Entity =
4430 InitializedEntity::InitializeParameter(Context&: S.Context, Parm: Param);
4431
4432 ExprResult Arg = E->getArg(Arg: ArgIndex);
4433 Arg = S.PerformCopyInitialization(Entity, EqualLoc: SourceLocation(), Init: Arg);
4434 if (Arg.isInvalid())
4435 return true;
4436
4437 E->setArg(Arg: ArgIndex, ArgExpr: Arg.get());
4438 return false;
4439}
4440
4441ExprResult Sema::BuiltinAtomicOverloaded(ExprResult TheCallResult) {
4442 CallExpr *TheCall = static_cast<CallExpr *>(TheCallResult.get());
4443 Expr *Callee = TheCall->getCallee();
4444 DeclRefExpr *DRE = cast<DeclRefExpr>(Val: Callee->IgnoreParenCasts());
4445 FunctionDecl *FDecl = cast<FunctionDecl>(Val: DRE->getDecl());
4446
4447 // Ensure that we have at least one argument to do type inference from.
4448 if (TheCall->getNumArgs() < 1) {
4449 Diag(TheCall->getEndLoc(), diag::err_typecheck_call_too_few_args_at_least)
4450 << 0 << 1 << TheCall->getNumArgs() << /*is non object*/ 0
4451 << Callee->getSourceRange();
4452 return ExprError();
4453 }
4454
4455 // Inspect the first argument of the atomic builtin. This should always be
4456 // a pointer type, whose element is an integral scalar or pointer type.
4457 // Because it is a pointer type, we don't have to worry about any implicit
4458 // casts here.
4459 // FIXME: We don't allow floating point scalars as input.
4460 Expr *FirstArg = TheCall->getArg(Arg: 0);
4461 ExprResult FirstArgResult = DefaultFunctionArrayLvalueConversion(E: FirstArg);
4462 if (FirstArgResult.isInvalid())
4463 return ExprError();
4464 FirstArg = FirstArgResult.get();
4465 TheCall->setArg(Arg: 0, ArgExpr: FirstArg);
4466
4467 const PointerType *pointerType = FirstArg->getType()->getAs<PointerType>();
4468 if (!pointerType) {
4469 Diag(DRE->getBeginLoc(), diag::err_atomic_builtin_must_be_pointer)
4470 << FirstArg->getType() << 0 << FirstArg->getSourceRange();
4471 return ExprError();
4472 }
4473
4474 QualType ValType = pointerType->getPointeeType();
4475 if (!ValType->isIntegerType() && !ValType->isAnyPointerType() &&
4476 !ValType->isBlockPointerType()) {
4477 Diag(DRE->getBeginLoc(), diag::err_atomic_builtin_must_be_pointer_intptr)
4478 << FirstArg->getType() << 0 << FirstArg->getSourceRange();
4479 return ExprError();
4480 }
4481 PointerAuthQualifier PointerAuth = ValType.getPointerAuth();
4482 if (PointerAuth && PointerAuth.isAddressDiscriminated()) {
4483 Diag(FirstArg->getBeginLoc(),
4484 diag::err_atomic_op_needs_non_address_discriminated_pointer)
4485 << 1 << ValType << FirstArg->getSourceRange();
4486 return ExprError();
4487 }
4488
4489 if (ValType.isConstQualified()) {
4490 Diag(DRE->getBeginLoc(), diag::err_atomic_builtin_cannot_be_const)
4491 << FirstArg->getType() << FirstArg->getSourceRange();
4492 return ExprError();
4493 }
4494
4495 switch (ValType.getObjCLifetime()) {
4496 case Qualifiers::OCL_None:
4497 case Qualifiers::OCL_ExplicitNone:
4498 // okay
4499 break;
4500
4501 case Qualifiers::OCL_Weak:
4502 case Qualifiers::OCL_Strong:
4503 case Qualifiers::OCL_Autoreleasing:
4504 Diag(DRE->getBeginLoc(), diag::err_arc_atomic_ownership)
4505 << ValType << FirstArg->getSourceRange();
4506 return ExprError();
4507 }
4508
4509 // Strip any qualifiers off ValType.
4510 ValType = ValType.getUnqualifiedType();
4511
4512 // The majority of builtins return a value, but a few have special return
4513 // types, so allow them to override appropriately below.
4514 QualType ResultType = ValType;
4515
4516 // We need to figure out which concrete builtin this maps onto. For example,
4517 // __sync_fetch_and_add with a 2 byte object turns into
4518 // __sync_fetch_and_add_2.
4519#define BUILTIN_ROW(x) \
4520 { Builtin::BI##x##_1, Builtin::BI##x##_2, Builtin::BI##x##_4, \
4521 Builtin::BI##x##_8, Builtin::BI##x##_16 }
4522
4523 static const unsigned BuiltinIndices[][5] = {
4524 BUILTIN_ROW(__sync_fetch_and_add),
4525 BUILTIN_ROW(__sync_fetch_and_sub),
4526 BUILTIN_ROW(__sync_fetch_and_or),
4527 BUILTIN_ROW(__sync_fetch_and_and),
4528 BUILTIN_ROW(__sync_fetch_and_xor),
4529 BUILTIN_ROW(__sync_fetch_and_nand),
4530
4531 BUILTIN_ROW(__sync_add_and_fetch),
4532 BUILTIN_ROW(__sync_sub_and_fetch),
4533 BUILTIN_ROW(__sync_and_and_fetch),
4534 BUILTIN_ROW(__sync_or_and_fetch),
4535 BUILTIN_ROW(__sync_xor_and_fetch),
4536 BUILTIN_ROW(__sync_nand_and_fetch),
4537
4538 BUILTIN_ROW(__sync_val_compare_and_swap),
4539 BUILTIN_ROW(__sync_bool_compare_and_swap),
4540 BUILTIN_ROW(__sync_lock_test_and_set),
4541 BUILTIN_ROW(__sync_lock_release),
4542 BUILTIN_ROW(__sync_swap)
4543 };
4544#undef BUILTIN_ROW
4545
4546 // Determine the index of the size.
4547 unsigned SizeIndex;
4548 switch (Context.getTypeSizeInChars(T: ValType).getQuantity()) {
4549 case 1: SizeIndex = 0; break;
4550 case 2: SizeIndex = 1; break;
4551 case 4: SizeIndex = 2; break;
4552 case 8: SizeIndex = 3; break;
4553 case 16: SizeIndex = 4; break;
4554 default:
4555 Diag(DRE->getBeginLoc(), diag::err_atomic_builtin_pointer_size)
4556 << FirstArg->getType() << FirstArg->getSourceRange();
4557 return ExprError();
4558 }
4559
4560 // Each of these builtins has one pointer argument, followed by some number of
4561 // values (0, 1 or 2) followed by a potentially empty varags list of stuff
4562 // that we ignore. Find out which row of BuiltinIndices to read from as well
4563 // as the number of fixed args.
4564 unsigned BuiltinID = FDecl->getBuiltinID();
4565 unsigned BuiltinIndex, NumFixed = 1;
4566 bool WarnAboutSemanticsChange = false;
4567 switch (BuiltinID) {
4568 default: llvm_unreachable("Unknown overloaded atomic builtin!");
4569 case Builtin::BI__sync_fetch_and_add:
4570 case Builtin::BI__sync_fetch_and_add_1:
4571 case Builtin::BI__sync_fetch_and_add_2:
4572 case Builtin::BI__sync_fetch_and_add_4:
4573 case Builtin::BI__sync_fetch_and_add_8:
4574 case Builtin::BI__sync_fetch_and_add_16:
4575 BuiltinIndex = 0;
4576 break;
4577
4578 case Builtin::BI__sync_fetch_and_sub:
4579 case Builtin::BI__sync_fetch_and_sub_1:
4580 case Builtin::BI__sync_fetch_and_sub_2:
4581 case Builtin::BI__sync_fetch_and_sub_4:
4582 case Builtin::BI__sync_fetch_and_sub_8:
4583 case Builtin::BI__sync_fetch_and_sub_16:
4584 BuiltinIndex = 1;
4585 break;
4586
4587 case Builtin::BI__sync_fetch_and_or:
4588 case Builtin::BI__sync_fetch_and_or_1:
4589 case Builtin::BI__sync_fetch_and_or_2:
4590 case Builtin::BI__sync_fetch_and_or_4:
4591 case Builtin::BI__sync_fetch_and_or_8:
4592 case Builtin::BI__sync_fetch_and_or_16:
4593 BuiltinIndex = 2;
4594 break;
4595
4596 case Builtin::BI__sync_fetch_and_and:
4597 case Builtin::BI__sync_fetch_and_and_1:
4598 case Builtin::BI__sync_fetch_and_and_2:
4599 case Builtin::BI__sync_fetch_and_and_4:
4600 case Builtin::BI__sync_fetch_and_and_8:
4601 case Builtin::BI__sync_fetch_and_and_16:
4602 BuiltinIndex = 3;
4603 break;
4604
4605 case Builtin::BI__sync_fetch_and_xor:
4606 case Builtin::BI__sync_fetch_and_xor_1:
4607 case Builtin::BI__sync_fetch_and_xor_2:
4608 case Builtin::BI__sync_fetch_and_xor_4:
4609 case Builtin::BI__sync_fetch_and_xor_8:
4610 case Builtin::BI__sync_fetch_and_xor_16:
4611 BuiltinIndex = 4;
4612 break;
4613
4614 case Builtin::BI__sync_fetch_and_nand:
4615 case Builtin::BI__sync_fetch_and_nand_1:
4616 case Builtin::BI__sync_fetch_and_nand_2:
4617 case Builtin::BI__sync_fetch_and_nand_4:
4618 case Builtin::BI__sync_fetch_and_nand_8:
4619 case Builtin::BI__sync_fetch_and_nand_16:
4620 BuiltinIndex = 5;
4621 WarnAboutSemanticsChange = true;
4622 break;
4623
4624 case Builtin::BI__sync_add_and_fetch:
4625 case Builtin::BI__sync_add_and_fetch_1:
4626 case Builtin::BI__sync_add_and_fetch_2:
4627 case Builtin::BI__sync_add_and_fetch_4:
4628 case Builtin::BI__sync_add_and_fetch_8:
4629 case Builtin::BI__sync_add_and_fetch_16:
4630 BuiltinIndex = 6;
4631 break;
4632
4633 case Builtin::BI__sync_sub_and_fetch:
4634 case Builtin::BI__sync_sub_and_fetch_1:
4635 case Builtin::BI__sync_sub_and_fetch_2:
4636 case Builtin::BI__sync_sub_and_fetch_4:
4637 case Builtin::BI__sync_sub_and_fetch_8:
4638 case Builtin::BI__sync_sub_and_fetch_16:
4639 BuiltinIndex = 7;
4640 break;
4641
4642 case Builtin::BI__sync_and_and_fetch:
4643 case Builtin::BI__sync_and_and_fetch_1:
4644 case Builtin::BI__sync_and_and_fetch_2:
4645 case Builtin::BI__sync_and_and_fetch_4:
4646 case Builtin::BI__sync_and_and_fetch_8:
4647 case Builtin::BI__sync_and_and_fetch_16:
4648 BuiltinIndex = 8;
4649 break;
4650
4651 case Builtin::BI__sync_or_and_fetch:
4652 case Builtin::BI__sync_or_and_fetch_1:
4653 case Builtin::BI__sync_or_and_fetch_2:
4654 case Builtin::BI__sync_or_and_fetch_4:
4655 case Builtin::BI__sync_or_and_fetch_8:
4656 case Builtin::BI__sync_or_and_fetch_16:
4657 BuiltinIndex = 9;
4658 break;
4659
4660 case Builtin::BI__sync_xor_and_fetch:
4661 case Builtin::BI__sync_xor_and_fetch_1:
4662 case Builtin::BI__sync_xor_and_fetch_2:
4663 case Builtin::BI__sync_xor_and_fetch_4:
4664 case Builtin::BI__sync_xor_and_fetch_8:
4665 case Builtin::BI__sync_xor_and_fetch_16:
4666 BuiltinIndex = 10;
4667 break;
4668
4669 case Builtin::BI__sync_nand_and_fetch:
4670 case Builtin::BI__sync_nand_and_fetch_1:
4671 case Builtin::BI__sync_nand_and_fetch_2:
4672 case Builtin::BI__sync_nand_and_fetch_4:
4673 case Builtin::BI__sync_nand_and_fetch_8:
4674 case Builtin::BI__sync_nand_and_fetch_16:
4675 BuiltinIndex = 11;
4676 WarnAboutSemanticsChange = true;
4677 break;
4678
4679 case Builtin::BI__sync_val_compare_and_swap:
4680 case Builtin::BI__sync_val_compare_and_swap_1:
4681 case Builtin::BI__sync_val_compare_and_swap_2:
4682 case Builtin::BI__sync_val_compare_and_swap_4:
4683 case Builtin::BI__sync_val_compare_and_swap_8:
4684 case Builtin::BI__sync_val_compare_and_swap_16:
4685 BuiltinIndex = 12;
4686 NumFixed = 2;
4687 break;
4688
4689 case Builtin::BI__sync_bool_compare_and_swap:
4690 case Builtin::BI__sync_bool_compare_and_swap_1:
4691 case Builtin::BI__sync_bool_compare_and_swap_2:
4692 case Builtin::BI__sync_bool_compare_and_swap_4:
4693 case Builtin::BI__sync_bool_compare_and_swap_8:
4694 case Builtin::BI__sync_bool_compare_and_swap_16:
4695 BuiltinIndex = 13;
4696 NumFixed = 2;
4697 ResultType = Context.BoolTy;
4698 break;
4699
4700 case Builtin::BI__sync_lock_test_and_set:
4701 case Builtin::BI__sync_lock_test_and_set_1:
4702 case Builtin::BI__sync_lock_test_and_set_2:
4703 case Builtin::BI__sync_lock_test_and_set_4:
4704 case Builtin::BI__sync_lock_test_and_set_8:
4705 case Builtin::BI__sync_lock_test_and_set_16:
4706 BuiltinIndex = 14;
4707 break;
4708
4709 case Builtin::BI__sync_lock_release:
4710 case Builtin::BI__sync_lock_release_1:
4711 case Builtin::BI__sync_lock_release_2:
4712 case Builtin::BI__sync_lock_release_4:
4713 case Builtin::BI__sync_lock_release_8:
4714 case Builtin::BI__sync_lock_release_16:
4715 BuiltinIndex = 15;
4716 NumFixed = 0;
4717 ResultType = Context.VoidTy;
4718 break;
4719
4720 case Builtin::BI__sync_swap:
4721 case Builtin::BI__sync_swap_1:
4722 case Builtin::BI__sync_swap_2:
4723 case Builtin::BI__sync_swap_4:
4724 case Builtin::BI__sync_swap_8:
4725 case Builtin::BI__sync_swap_16:
4726 BuiltinIndex = 16;
4727 break;
4728 }
4729
4730 // Now that we know how many fixed arguments we expect, first check that we
4731 // have at least that many.
4732 if (TheCall->getNumArgs() < 1+NumFixed) {
4733 Diag(TheCall->getEndLoc(), diag::err_typecheck_call_too_few_args_at_least)
4734 << 0 << 1 + NumFixed << TheCall->getNumArgs() << /*is non object*/ 0
4735 << Callee->getSourceRange();
4736 return ExprError();
4737 }
4738
4739 Diag(TheCall->getEndLoc(), diag::warn_atomic_implicit_seq_cst)
4740 << Callee->getSourceRange();
4741
4742 if (WarnAboutSemanticsChange) {
4743 Diag(TheCall->getEndLoc(), diag::warn_sync_fetch_and_nand_semantics_change)
4744 << Callee->getSourceRange();
4745 }
4746
4747 // Get the decl for the concrete builtin from this, we can tell what the
4748 // concrete integer type we should convert to is.
4749 unsigned NewBuiltinID = BuiltinIndices[BuiltinIndex][SizeIndex];
4750 std::string NewBuiltinName = Context.BuiltinInfo.getName(ID: NewBuiltinID);
4751 FunctionDecl *NewBuiltinDecl;
4752 if (NewBuiltinID == BuiltinID)
4753 NewBuiltinDecl = FDecl;
4754 else {
4755 // Perform builtin lookup to avoid redeclaring it.
4756 DeclarationName DN(&Context.Idents.get(Name: NewBuiltinName));
4757 LookupResult Res(*this, DN, DRE->getBeginLoc(), LookupOrdinaryName);
4758 LookupName(R&: Res, S: TUScope, /*AllowBuiltinCreation=*/true);
4759 assert(Res.getFoundDecl());
4760 NewBuiltinDecl = dyn_cast<FunctionDecl>(Val: Res.getFoundDecl());
4761 if (!NewBuiltinDecl)
4762 return ExprError();
4763 }
4764
4765 // The first argument --- the pointer --- has a fixed type; we
4766 // deduce the types of the rest of the arguments accordingly. Walk
4767 // the remaining arguments, converting them to the deduced value type.
4768 for (unsigned i = 0; i != NumFixed; ++i) {
4769 ExprResult Arg = TheCall->getArg(Arg: i+1);
4770
4771 // GCC does an implicit conversion to the pointer or integer ValType. This
4772 // can fail in some cases (1i -> int**), check for this error case now.
4773 // Initialize the argument.
4774 InitializedEntity Entity = InitializedEntity::InitializeParameter(Context,
4775 Type: ValType, /*consume*/ Consumed: false);
4776 Arg = PerformCopyInitialization(Entity, EqualLoc: SourceLocation(), Init: Arg);
4777 if (Arg.isInvalid())
4778 return ExprError();
4779
4780 // Okay, we have something that *can* be converted to the right type. Check
4781 // to see if there is a potentially weird extension going on here. This can
4782 // happen when you do an atomic operation on something like an char* and
4783 // pass in 42. The 42 gets converted to char. This is even more strange
4784 // for things like 45.123 -> char, etc.
4785 // FIXME: Do this check.
4786 TheCall->setArg(Arg: i+1, ArgExpr: Arg.get());
4787 }
4788
4789 // Create a new DeclRefExpr to refer to the new decl.
4790 DeclRefExpr *NewDRE = DeclRefExpr::Create(
4791 Context, DRE->getQualifierLoc(), SourceLocation(), NewBuiltinDecl,
4792 /*enclosing*/ false, DRE->getLocation(), Context.BuiltinFnTy,
4793 DRE->getValueKind(), nullptr, nullptr, DRE->isNonOdrUse());
4794
4795 // Set the callee in the CallExpr.
4796 // FIXME: This loses syntactic information.
4797 QualType CalleePtrTy = Context.getPointerType(NewBuiltinDecl->getType());
4798 ExprResult PromotedCall = ImpCastExprToType(NewDRE, CalleePtrTy,
4799 CK_BuiltinFnToFnPtr);
4800 TheCall->setCallee(PromotedCall.get());
4801
4802 // Change the result type of the call to match the original value type. This
4803 // is arbitrary, but the codegen for these builtins ins design to handle it
4804 // gracefully.
4805 TheCall->setType(ResultType);
4806
4807 // Prohibit problematic uses of bit-precise integer types with atomic
4808 // builtins. The arguments would have already been converted to the first
4809 // argument's type, so only need to check the first argument.
4810 const auto *BitIntValType = ValType->getAs<BitIntType>();
4811 if (BitIntValType && !llvm::isPowerOf2_64(Value: BitIntValType->getNumBits())) {
4812 Diag(FirstArg->getExprLoc(), diag::err_atomic_builtin_ext_int_size);
4813 return ExprError();
4814 }
4815
4816 return TheCallResult;
4817}
4818
4819ExprResult Sema::BuiltinNontemporalOverloaded(ExprResult TheCallResult) {
4820 CallExpr *TheCall = (CallExpr *)TheCallResult.get();
4821 DeclRefExpr *DRE =
4822 cast<DeclRefExpr>(Val: TheCall->getCallee()->IgnoreParenCasts());
4823 FunctionDecl *FDecl = cast<FunctionDecl>(Val: DRE->getDecl());
4824 unsigned BuiltinID = FDecl->getBuiltinID();
4825 assert((BuiltinID == Builtin::BI__builtin_nontemporal_store ||
4826 BuiltinID == Builtin::BI__builtin_nontemporal_load) &&
4827 "Unexpected nontemporal load/store builtin!");
4828 bool isStore = BuiltinID == Builtin::BI__builtin_nontemporal_store;
4829 unsigned numArgs = isStore ? 2 : 1;
4830
4831 // Ensure that we have the proper number of arguments.
4832 if (checkArgCount(Call: TheCall, DesiredArgCount: numArgs))
4833 return ExprError();
4834
4835 // Inspect the last argument of the nontemporal builtin. This should always
4836 // be a pointer type, from which we imply the type of the memory access.
4837 // Because it is a pointer type, we don't have to worry about any implicit
4838 // casts here.
4839 Expr *PointerArg = TheCall->getArg(Arg: numArgs - 1);
4840 ExprResult PointerArgResult =
4841 DefaultFunctionArrayLvalueConversion(E: PointerArg);
4842
4843 if (PointerArgResult.isInvalid())
4844 return ExprError();
4845 PointerArg = PointerArgResult.get();
4846 TheCall->setArg(Arg: numArgs - 1, ArgExpr: PointerArg);
4847
4848 const PointerType *pointerType = PointerArg->getType()->getAs<PointerType>();
4849 if (!pointerType) {
4850 Diag(DRE->getBeginLoc(), diag::err_nontemporal_builtin_must_be_pointer)
4851 << PointerArg->getType() << PointerArg->getSourceRange();
4852 return ExprError();
4853 }
4854
4855 QualType ValType = pointerType->getPointeeType();
4856
4857 // Strip any qualifiers off ValType.
4858 ValType = ValType.getUnqualifiedType();
4859 if (!ValType->isIntegerType() && !ValType->isAnyPointerType() &&
4860 !ValType->isBlockPointerType() && !ValType->isFloatingType() &&
4861 !ValType->isVectorType()) {
4862 Diag(DRE->getBeginLoc(),
4863 diag::err_nontemporal_builtin_must_be_pointer_intfltptr_or_vector)
4864 << PointerArg->getType() << PointerArg->getSourceRange();
4865 return ExprError();
4866 }
4867
4868 if (!isStore) {
4869 TheCall->setType(ValType);
4870 return TheCallResult;
4871 }
4872
4873 ExprResult ValArg = TheCall->getArg(Arg: 0);
4874 InitializedEntity Entity = InitializedEntity::InitializeParameter(
4875 Context, Type: ValType, /*consume*/ Consumed: false);
4876 ValArg = PerformCopyInitialization(Entity, EqualLoc: SourceLocation(), Init: ValArg);
4877 if (ValArg.isInvalid())
4878 return ExprError();
4879
4880 TheCall->setArg(Arg: 0, ArgExpr: ValArg.get());
4881 TheCall->setType(Context.VoidTy);
4882 return TheCallResult;
4883}
4884
4885/// CheckObjCString - Checks that the format string argument to the os_log()
4886/// and os_trace() functions is correct, and converts it to const char *.
4887ExprResult Sema::CheckOSLogFormatStringArg(Expr *Arg) {
4888 Arg = Arg->IgnoreParenCasts();
4889 auto *Literal = dyn_cast<StringLiteral>(Val: Arg);
4890 if (!Literal) {
4891 if (auto *ObjcLiteral = dyn_cast<ObjCStringLiteral>(Val: Arg)) {
4892 Literal = ObjcLiteral->getString();
4893 }
4894 }
4895
4896 if (!Literal || (!Literal->isOrdinary() && !Literal->isUTF8())) {
4897 return ExprError(
4898 Diag(Arg->getBeginLoc(), diag::err_os_log_format_not_string_constant)
4899 << Arg->getSourceRange());
4900 }
4901
4902 ExprResult Result(Literal);
4903 QualType ResultTy = Context.getPointerType(Context.CharTy.withConst());
4904 InitializedEntity Entity =
4905 InitializedEntity::InitializeParameter(Context, Type: ResultTy, Consumed: false);
4906 Result = PerformCopyInitialization(Entity, EqualLoc: SourceLocation(), Init: Result);
4907 return Result;
4908}
4909
4910/// Check that the user is calling the appropriate va_start builtin for the
4911/// target and calling convention.
4912static bool checkVAStartABI(Sema &S, unsigned BuiltinID, Expr *Fn) {
4913 const llvm::Triple &TT = S.Context.getTargetInfo().getTriple();
4914 bool IsX64 = TT.getArch() == llvm::Triple::x86_64;
4915 bool IsAArch64 = (TT.getArch() == llvm::Triple::aarch64 ||
4916 TT.getArch() == llvm::Triple::aarch64_32);
4917 bool IsWindowsOrUEFI = TT.isOSWindows() || TT.isUEFI();
4918 bool IsMSVAStart = BuiltinID == Builtin::BI__builtin_ms_va_start;
4919 if (IsX64 || IsAArch64) {
4920 CallingConv CC = CC_C;
4921 if (const FunctionDecl *FD = S.getCurFunctionDecl())
4922 CC = FD->getType()->castAs<FunctionType>()->getCallConv();
4923 if (IsMSVAStart) {
4924 // Don't allow this in System V ABI functions.
4925 if (CC == CC_X86_64SysV || (!IsWindowsOrUEFI && CC != CC_Win64))
4926 return S.Diag(Fn->getBeginLoc(),
4927 diag::err_ms_va_start_used_in_sysv_function);
4928 } else {
4929 // On x86-64/AArch64 Unix, don't allow this in Win64 ABI functions.
4930 // On x64 Windows, don't allow this in System V ABI functions.
4931 // (Yes, that means there's no corresponding way to support variadic
4932 // System V ABI functions on Windows.)
4933 if ((IsWindowsOrUEFI && CC == CC_X86_64SysV) ||
4934 (!IsWindowsOrUEFI && CC == CC_Win64))
4935 return S.Diag(Fn->getBeginLoc(),
4936 diag::err_va_start_used_in_wrong_abi_function)
4937 << !IsWindowsOrUEFI;
4938 }
4939 return false;
4940 }
4941
4942 if (IsMSVAStart)
4943 return S.Diag(Fn->getBeginLoc(), diag::err_builtin_x64_aarch64_only);
4944 return false;
4945}
4946
4947static bool checkVAStartIsInVariadicFunction(Sema &S, Expr *Fn,
4948 ParmVarDecl **LastParam = nullptr) {
4949 // Determine whether the current function, block, or obj-c method is variadic
4950 // and get its parameter list.
4951 bool IsVariadic = false;
4952 ArrayRef<ParmVarDecl *> Params;
4953 DeclContext *Caller = S.CurContext;
4954 if (auto *Block = dyn_cast<BlockDecl>(Val: Caller)) {
4955 IsVariadic = Block->isVariadic();
4956 Params = Block->parameters();
4957 } else if (auto *FD = dyn_cast<FunctionDecl>(Val: Caller)) {
4958 IsVariadic = FD->isVariadic();
4959 Params = FD->parameters();
4960 } else if (auto *MD = dyn_cast<ObjCMethodDecl>(Val: Caller)) {
4961 IsVariadic = MD->isVariadic();
4962 // FIXME: This isn't correct for methods (results in bogus warning).
4963 Params = MD->parameters();
4964 } else if (isa<CapturedDecl>(Val: Caller)) {
4965 // We don't support va_start in a CapturedDecl.
4966 S.Diag(Fn->getBeginLoc(), diag::err_va_start_captured_stmt);
4967 return true;
4968 } else {
4969 // This must be some other declcontext that parses exprs.
4970 S.Diag(Fn->getBeginLoc(), diag::err_va_start_outside_function);
4971 return true;
4972 }
4973
4974 if (!IsVariadic) {
4975 S.Diag(Fn->getBeginLoc(), diag::err_va_start_fixed_function);
4976 return true;
4977 }
4978
4979 if (LastParam)
4980 *LastParam = Params.empty() ? nullptr : Params.back();
4981
4982 return false;
4983}
4984
4985bool Sema::BuiltinVAStart(unsigned BuiltinID, CallExpr *TheCall) {
4986 Expr *Fn = TheCall->getCallee();
4987 if (checkVAStartABI(S&: *this, BuiltinID, Fn))
4988 return true;
4989
4990 if (BuiltinID == Builtin::BI__builtin_c23_va_start) {
4991 // This builtin requires one argument (the va_list), allows two arguments,
4992 // but diagnoses more than two arguments. e.g.,
4993 // __builtin_c23_va_start(); // error
4994 // __builtin_c23_va_start(list); // ok
4995 // __builtin_c23_va_start(list, param); // ok
4996 // __builtin_c23_va_start(list, anything, anything); // error
4997 // This differs from the GCC behavior in that they accept the last case
4998 // with a warning, but it doesn't seem like a useful behavior to allow.
4999 if (checkArgCountRange(Call: TheCall, MinArgCount: 1, MaxArgCount: 2))
5000 return true;
5001 } else {
5002 // In C23 mode, va_start only needs one argument. However, the builtin still
5003 // requires two arguments (which matches the behavior of the GCC builtin),
5004 // <stdarg.h> passes `0` as the second argument in C23 mode.
5005 if (checkArgCount(Call: TheCall, DesiredArgCount: 2))
5006 return true;
5007 }
5008
5009 // Type-check the first argument normally.
5010 if (checkBuiltinArgument(S&: *this, E: TheCall, ArgIndex: 0))
5011 return true;
5012
5013 // Check that the current function is variadic, and get its last parameter.
5014 ParmVarDecl *LastParam;
5015 if (checkVAStartIsInVariadicFunction(S&: *this, Fn, LastParam: &LastParam))
5016 return true;
5017
5018 // Verify that the second argument to the builtin is the last non-variadic
5019 // argument of the current function or method. In C23 mode, if the call is
5020 // not to __builtin_c23_va_start, and the second argument is an integer
5021 // constant expression with value 0, then we don't bother with this check.
5022 // For __builtin_c23_va_start, we only perform the check for the second
5023 // argument being the last argument to the current function if there is a
5024 // second argument present.
5025 if (BuiltinID == Builtin::BI__builtin_c23_va_start &&
5026 TheCall->getNumArgs() < 2) {
5027 Diag(TheCall->getExprLoc(), diag::warn_c17_compat_va_start_one_arg);
5028 return false;
5029 }
5030
5031 const Expr *Arg = TheCall->getArg(Arg: 1)->IgnoreParenCasts();
5032 if (std::optional<llvm::APSInt> Val =
5033 TheCall->getArg(Arg: 1)->getIntegerConstantExpr(Ctx: Context);
5034 Val && LangOpts.C23 && *Val == 0 &&
5035 BuiltinID != Builtin::BI__builtin_c23_va_start) {
5036 Diag(TheCall->getExprLoc(), diag::warn_c17_compat_va_start_one_arg);
5037 return false;
5038 }
5039
5040 // These are valid if SecondArgIsLastNonVariadicArgument is false after the
5041 // next block.
5042 QualType Type;
5043 SourceLocation ParamLoc;
5044 bool IsCRegister = false;
5045 bool SecondArgIsLastNonVariadicArgument = false;
5046 if (const DeclRefExpr *DR = dyn_cast<DeclRefExpr>(Val: Arg)) {
5047 if (const ParmVarDecl *PV = dyn_cast<ParmVarDecl>(Val: DR->getDecl())) {
5048 SecondArgIsLastNonVariadicArgument = PV == LastParam;
5049
5050 Type = PV->getType();
5051 ParamLoc = PV->getLocation();
5052 IsCRegister =
5053 PV->getStorageClass() == SC_Register && !getLangOpts().CPlusPlus;
5054 }
5055 }
5056
5057 if (!SecondArgIsLastNonVariadicArgument)
5058 Diag(TheCall->getArg(1)->getBeginLoc(),
5059 diag::warn_second_arg_of_va_start_not_last_non_variadic_param);
5060 else if (IsCRegister || Type->isReferenceType() ||
5061 Type->isSpecificBuiltinType(K: BuiltinType::Float) || [=] {
5062 // Promotable integers are UB, but enumerations need a bit of
5063 // extra checking to see what their promotable type actually is.
5064 if (!Context.isPromotableIntegerType(T: Type))
5065 return false;
5066 if (!Type->isEnumeralType())
5067 return true;
5068 const EnumDecl *ED = Type->castAs<EnumType>()->getDecl();
5069 return !(ED &&
5070 Context.typesAreCompatible(T1: ED->getPromotionType(), T2: Type));
5071 }()) {
5072 unsigned Reason = 0;
5073 if (Type->isReferenceType()) Reason = 1;
5074 else if (IsCRegister) Reason = 2;
5075 Diag(Arg->getBeginLoc(), diag::warn_va_start_type_is_undefined) << Reason;
5076 Diag(ParamLoc, diag::note_parameter_type) << Type;
5077 }
5078
5079 return false;
5080}
5081
5082bool Sema::BuiltinVAStartARMMicrosoft(CallExpr *Call) {
5083 auto IsSuitablyTypedFormatArgument = [this](const Expr *Arg) -> bool {
5084 const LangOptions &LO = getLangOpts();
5085
5086 if (LO.CPlusPlus)
5087 return Arg->getType()
5088 .getCanonicalType()
5089 .getTypePtr()
5090 ->getPointeeType()
5091 .withoutLocalFastQualifiers() == Context.CharTy;
5092
5093 // In C, allow aliasing through `char *`, this is required for AArch64 at
5094 // least.
5095 return true;
5096 };
5097
5098 // void __va_start(va_list *ap, const char *named_addr, size_t slot_size,
5099 // const char *named_addr);
5100
5101 Expr *Func = Call->getCallee();
5102
5103 if (Call->getNumArgs() < 3)
5104 return Diag(Call->getEndLoc(),
5105 diag::err_typecheck_call_too_few_args_at_least)
5106 << 0 /*function call*/ << 3 << Call->getNumArgs()
5107 << /*is non object*/ 0;
5108
5109 // Type-check the first argument normally.
5110 if (checkBuiltinArgument(S&: *this, E: Call, ArgIndex: 0))
5111 return true;
5112
5113 // Check that the current function is variadic.
5114 if (checkVAStartIsInVariadicFunction(S&: *this, Fn: Func))
5115 return true;
5116
5117 // __va_start on Windows does not validate the parameter qualifiers
5118
5119 const Expr *Arg1 = Call->getArg(Arg: 1)->IgnoreParens();
5120 const Type *Arg1Ty = Arg1->getType().getCanonicalType().getTypePtr();
5121
5122 const Expr *Arg2 = Call->getArg(Arg: 2)->IgnoreParens();
5123 const Type *Arg2Ty = Arg2->getType().getCanonicalType().getTypePtr();
5124
5125 const QualType &ConstCharPtrTy =
5126 Context.getPointerType(Context.CharTy.withConst());
5127 if (!Arg1Ty->isPointerType() || !IsSuitablyTypedFormatArgument(Arg1))
5128 Diag(Arg1->getBeginLoc(), diag::err_typecheck_convert_incompatible)
5129 << Arg1->getType() << ConstCharPtrTy << 1 /* different class */
5130 << 0 /* qualifier difference */
5131 << 3 /* parameter mismatch */
5132 << 2 << Arg1->getType() << ConstCharPtrTy;
5133
5134 const QualType SizeTy = Context.getSizeType();
5135 if (Arg2Ty->getCanonicalTypeInternal().withoutLocalFastQualifiers() != SizeTy)
5136 Diag(Arg2->getBeginLoc(), diag::err_typecheck_convert_incompatible)
5137 << Arg2->getType() << SizeTy << 1 /* different class */
5138 << 0 /* qualifier difference */
5139 << 3 /* parameter mismatch */
5140 << 3 << Arg2->getType() << SizeTy;
5141
5142 return false;
5143}
5144
5145bool Sema::BuiltinUnorderedCompare(CallExpr *TheCall, unsigned BuiltinID) {
5146 if (checkArgCount(Call: TheCall, DesiredArgCount: 2))
5147 return true;
5148
5149 if (BuiltinID == Builtin::BI__builtin_isunordered &&
5150 TheCall->getFPFeaturesInEffect(getLangOpts()).getNoHonorNaNs())
5151 Diag(TheCall->getBeginLoc(), diag::warn_fp_nan_inf_when_disabled)
5152 << 1 << 0 << TheCall->getSourceRange();
5153
5154 ExprResult OrigArg0 = TheCall->getArg(Arg: 0);
5155 ExprResult OrigArg1 = TheCall->getArg(Arg: 1);
5156
5157 // Do standard promotions between the two arguments, returning their common
5158 // type.
5159 QualType Res = UsualArithmeticConversions(
5160 LHS&: OrigArg0, RHS&: OrigArg1, Loc: TheCall->getExprLoc(), ACK: ArithConvKind::Comparison);
5161 if (OrigArg0.isInvalid() || OrigArg1.isInvalid())
5162 return true;
5163
5164 // Make sure any conversions are pushed back into the call; this is
5165 // type safe since unordered compare builtins are declared as "_Bool
5166 // foo(...)".
5167 TheCall->setArg(Arg: 0, ArgExpr: OrigArg0.get());
5168 TheCall->setArg(Arg: 1, ArgExpr: OrigArg1.get());
5169
5170 if (OrigArg0.get()->isTypeDependent() || OrigArg1.get()->isTypeDependent())
5171 return false;
5172
5173 // If the common type isn't a real floating type, then the arguments were
5174 // invalid for this operation.
5175 if (Res.isNull() || !Res->isRealFloatingType())
5176 return Diag(OrigArg0.get()->getBeginLoc(),
5177 diag::err_typecheck_call_invalid_ordered_compare)
5178 << OrigArg0.get()->getType() << OrigArg1.get()->getType()
5179 << SourceRange(OrigArg0.get()->getBeginLoc(),
5180 OrigArg1.get()->getEndLoc());
5181
5182 return false;
5183}
5184
5185bool Sema::BuiltinFPClassification(CallExpr *TheCall, unsigned NumArgs,
5186 unsigned BuiltinID) {
5187 if (checkArgCount(Call: TheCall, DesiredArgCount: NumArgs))
5188 return true;
5189
5190 FPOptions FPO = TheCall->getFPFeaturesInEffect(LO: getLangOpts());
5191 if (FPO.getNoHonorInfs() && (BuiltinID == Builtin::BI__builtin_isfinite ||
5192 BuiltinID == Builtin::BI__builtin_isinf ||
5193 BuiltinID == Builtin::BI__builtin_isinf_sign))
5194 Diag(TheCall->getBeginLoc(), diag::warn_fp_nan_inf_when_disabled)
5195 << 0 << 0 << TheCall->getSourceRange();
5196
5197 if (FPO.getNoHonorNaNs() && (BuiltinID == Builtin::BI__builtin_isnan ||
5198 BuiltinID == Builtin::BI__builtin_isunordered))
5199 Diag(TheCall->getBeginLoc(), diag::warn_fp_nan_inf_when_disabled)
5200 << 1 << 0 << TheCall->getSourceRange();
5201
5202 bool IsFPClass = NumArgs == 2;
5203
5204 // Find out position of floating-point argument.
5205 unsigned FPArgNo = IsFPClass ? 0 : NumArgs - 1;
5206
5207 // We can count on all parameters preceding the floating-point just being int.
5208 // Try all of those.
5209 for (unsigned i = 0; i < FPArgNo; ++i) {
5210 Expr *Arg = TheCall->getArg(Arg: i);
5211
5212 if (Arg->isTypeDependent())
5213 return false;
5214
5215 ExprResult Res = PerformImplicitConversion(Arg, Context.IntTy,
5216 AssignmentAction::Passing);
5217
5218 if (Res.isInvalid())
5219 return true;
5220 TheCall->setArg(Arg: i, ArgExpr: Res.get());
5221 }
5222
5223 Expr *OrigArg = TheCall->getArg(Arg: FPArgNo);
5224
5225 if (OrigArg->isTypeDependent())
5226 return false;
5227
5228 // Usual Unary Conversions will convert half to float, which we want for
5229 // machines that use fp16 conversion intrinsics. Else, we wnat to leave the
5230 // type how it is, but do normal L->Rvalue conversions.
5231 if (Context.getTargetInfo().useFP16ConversionIntrinsics()) {
5232 ExprResult Res = UsualUnaryConversions(E: OrigArg);
5233
5234 if (!Res.isUsable())
5235 return true;
5236 OrigArg = Res.get();
5237 } else {
5238 ExprResult Res = DefaultFunctionArrayLvalueConversion(E: OrigArg);
5239
5240 if (!Res.isUsable())
5241 return true;
5242 OrigArg = Res.get();
5243 }
5244 TheCall->setArg(Arg: FPArgNo, ArgExpr: OrigArg);
5245
5246 QualType VectorResultTy;
5247 QualType ElementTy = OrigArg->getType();
5248 // TODO: When all classification function are implemented with is_fpclass,
5249 // vector argument can be supported in all of them.
5250 if (ElementTy->isVectorType() && IsFPClass) {
5251 VectorResultTy = GetSignedVectorType(V: ElementTy);
5252 ElementTy = ElementTy->castAs<VectorType>()->getElementType();
5253 }
5254
5255 // This operation requires a non-_Complex floating-point number.
5256 if (!ElementTy->isRealFloatingType())
5257 return Diag(OrigArg->getBeginLoc(),
5258 diag::err_typecheck_call_invalid_unary_fp)
5259 << OrigArg->getType() << OrigArg->getSourceRange();
5260
5261 // __builtin_isfpclass has integer parameter that specify test mask. It is
5262 // passed in (...), so it should be analyzed completely here.
5263 if (IsFPClass)
5264 if (BuiltinConstantArgRange(TheCall, ArgNum: 1, Low: 0, High: llvm::fcAllFlags))
5265 return true;
5266
5267 // TODO: enable this code to all classification functions.
5268 if (IsFPClass) {
5269 QualType ResultTy;
5270 if (!VectorResultTy.isNull())
5271 ResultTy = VectorResultTy;
5272 else
5273 ResultTy = Context.IntTy;
5274 TheCall->setType(ResultTy);
5275 }
5276
5277 return false;
5278}
5279
5280bool Sema::BuiltinComplex(CallExpr *TheCall) {
5281 if (checkArgCount(Call: TheCall, DesiredArgCount: 2))
5282 return true;
5283
5284 bool Dependent = false;
5285 for (unsigned I = 0; I != 2; ++I) {
5286 Expr *Arg = TheCall->getArg(Arg: I);
5287 QualType T = Arg->getType();
5288 if (T->isDependentType()) {
5289 Dependent = true;
5290 continue;
5291 }
5292
5293 // Despite supporting _Complex int, GCC requires a real floating point type
5294 // for the operands of __builtin_complex.
5295 if (!T->isRealFloatingType()) {
5296 return Diag(Arg->getBeginLoc(), diag::err_typecheck_call_requires_real_fp)
5297 << Arg->getType() << Arg->getSourceRange();
5298 }
5299
5300 ExprResult Converted = DefaultLvalueConversion(E: Arg);
5301 if (Converted.isInvalid())
5302 return true;
5303 TheCall->setArg(Arg: I, ArgExpr: Converted.get());
5304 }
5305
5306 if (Dependent) {
5307 TheCall->setType(Context.DependentTy);
5308 return false;
5309 }
5310
5311 Expr *Real = TheCall->getArg(Arg: 0);
5312 Expr *Imag = TheCall->getArg(Arg: 1);
5313 if (!Context.hasSameType(T1: Real->getType(), T2: Imag->getType())) {
5314 return Diag(Real->getBeginLoc(),
5315 diag::err_typecheck_call_different_arg_types)
5316 << Real->getType() << Imag->getType()
5317 << Real->getSourceRange() << Imag->getSourceRange();
5318 }
5319
5320 // We don't allow _Complex _Float16 nor _Complex __fp16 as type specifiers;
5321 // don't allow this builtin to form those types either.
5322 // FIXME: Should we allow these types?
5323 if (Real->getType()->isFloat16Type())
5324 return Diag(TheCall->getBeginLoc(), diag::err_invalid_complex_spec)
5325 << "_Float16";
5326 if (Real->getType()->isHalfType())
5327 return Diag(TheCall->getBeginLoc(), diag::err_invalid_complex_spec)
5328 << "half";
5329
5330 TheCall->setType(Context.getComplexType(T: Real->getType()));
5331 return false;
5332}
5333
5334/// BuiltinShuffleVector - Handle __builtin_shufflevector.
5335// This is declared to take (...), so we have to check everything.
5336ExprResult Sema::BuiltinShuffleVector(CallExpr *TheCall) {
5337 if (TheCall->getNumArgs() < 2)
5338 return ExprError(Diag(TheCall->getEndLoc(),
5339 diag::err_typecheck_call_too_few_args_at_least)
5340 << 0 /*function call*/ << 2 << TheCall->getNumArgs()
5341 << /*is non object*/ 0 << TheCall->getSourceRange());
5342
5343 // Determine which of the following types of shufflevector we're checking:
5344 // 1) unary, vector mask: (lhs, mask)
5345 // 2) binary, scalar mask: (lhs, rhs, index, ..., index)
5346 QualType resType = TheCall->getArg(Arg: 0)->getType();
5347 unsigned numElements = 0;
5348
5349 if (!TheCall->getArg(Arg: 0)->isTypeDependent() &&
5350 !TheCall->getArg(Arg: 1)->isTypeDependent()) {
5351 QualType LHSType = TheCall->getArg(Arg: 0)->getType();
5352 QualType RHSType = TheCall->getArg(Arg: 1)->getType();
5353
5354 if (!LHSType->isVectorType() || !RHSType->isVectorType())
5355 return ExprError(
5356 Diag(TheCall->getBeginLoc(), diag::err_vec_builtin_non_vector)
5357 << TheCall->getDirectCallee() << /*isMorethantwoArgs*/ false
5358 << SourceRange(TheCall->getArg(0)->getBeginLoc(),
5359 TheCall->getArg(1)->getEndLoc()));
5360
5361 numElements = LHSType->castAs<VectorType>()->getNumElements();
5362 unsigned numResElements = TheCall->getNumArgs() - 2;
5363
5364 // Check to see if we have a call with 2 vector arguments, the unary shuffle
5365 // with mask. If so, verify that RHS is an integer vector type with the
5366 // same number of elts as lhs.
5367 if (TheCall->getNumArgs() == 2) {
5368 if (!RHSType->hasIntegerRepresentation() ||
5369 RHSType->castAs<VectorType>()->getNumElements() != numElements)
5370 return ExprError(Diag(TheCall->getBeginLoc(),
5371 diag::err_vec_builtin_incompatible_vector)
5372 << TheCall->getDirectCallee()
5373 << /*isMorethantwoArgs*/ false
5374 << SourceRange(TheCall->getArg(1)->getBeginLoc(),
5375 TheCall->getArg(1)->getEndLoc()));
5376 } else if (!Context.hasSameUnqualifiedType(T1: LHSType, T2: RHSType)) {
5377 return ExprError(Diag(TheCall->getBeginLoc(),
5378 diag::err_vec_builtin_incompatible_vector)
5379 << TheCall->getDirectCallee()
5380 << /*isMorethantwoArgs*/ false
5381 << SourceRange(TheCall->getArg(0)->getBeginLoc(),
5382 TheCall->getArg(1)->getEndLoc()));
5383 } else if (numElements != numResElements) {
5384 QualType eltType = LHSType->castAs<VectorType>()->getElementType();
5385 resType =
5386 Context.getVectorType(VectorType: eltType, NumElts: numResElements, VecKind: VectorKind::Generic);
5387 }
5388 }
5389
5390 for (unsigned i = 2; i < TheCall->getNumArgs(); i++) {
5391 Expr *Arg = TheCall->getArg(Arg: i);
5392 if (Arg->isTypeDependent() || Arg->isValueDependent())
5393 continue;
5394
5395 std::optional<llvm::APSInt> Result;
5396 if (!(Result = Arg->getIntegerConstantExpr(Context)))
5397 return ExprError(Diag(TheCall->getBeginLoc(),
5398 diag::err_shufflevector_nonconstant_argument)
5399 << Arg->getSourceRange());
5400
5401 // Allow -1 which will be translated to undef in the IR.
5402 if (Result->isSigned() && Result->isAllOnes())
5403 ;
5404 else if (Result->getActiveBits() > 64 ||
5405 Result->getZExtValue() >= numElements * 2)
5406 return ExprError(Diag(TheCall->getBeginLoc(),
5407 diag::err_shufflevector_argument_too_large)
5408 << Arg->getSourceRange());
5409
5410 TheCall->setArg(i, ConstantExpr::Create(Context, E: Arg, Result: APValue(*Result)));
5411 }
5412
5413 SmallVector<Expr *> exprs;
5414 for (unsigned i = 0, e = TheCall->getNumArgs(); i != e; i++) {
5415 exprs.push_back(Elt: TheCall->getArg(Arg: i));
5416 TheCall->setArg(Arg: i, ArgExpr: nullptr);
5417 }
5418
5419 return new (Context) ShuffleVectorExpr(Context, exprs, resType,
5420 TheCall->getCallee()->getBeginLoc(),
5421 TheCall->getRParenLoc());
5422}
5423
5424ExprResult Sema::ConvertVectorExpr(Expr *E, TypeSourceInfo *TInfo,
5425 SourceLocation BuiltinLoc,
5426 SourceLocation RParenLoc) {
5427 ExprValueKind VK = VK_PRValue;
5428 ExprObjectKind OK = OK_Ordinary;
5429 QualType DstTy = TInfo->getType();
5430 QualType SrcTy = E->getType();
5431
5432 if (!SrcTy->isVectorType() && !SrcTy->isDependentType())
5433 return ExprError(Diag(BuiltinLoc,
5434 diag::err_convertvector_non_vector)
5435 << E->getSourceRange());
5436 if (!DstTy->isVectorType() && !DstTy->isDependentType())
5437 return ExprError(Diag(BuiltinLoc, diag::err_builtin_non_vector_type)
5438 << "second"
5439 << "__builtin_convertvector");
5440
5441 if (!SrcTy->isDependentType() && !DstTy->isDependentType()) {
5442 unsigned SrcElts = SrcTy->castAs<VectorType>()->getNumElements();
5443 unsigned DstElts = DstTy->castAs<VectorType>()->getNumElements();
5444 if (SrcElts != DstElts)
5445 return ExprError(Diag(BuiltinLoc,
5446 diag::err_convertvector_incompatible_vector)
5447 << E->getSourceRange());
5448 }
5449
5450 return ConvertVectorExpr::Create(C: Context, SrcExpr: E, TI: TInfo, DstType: DstTy, VK, OK, BuiltinLoc,
5451 RParenLoc, FPFeatures: CurFPFeatureOverrides());
5452}
5453
5454bool Sema::BuiltinPrefetch(CallExpr *TheCall) {
5455 unsigned NumArgs = TheCall->getNumArgs();
5456
5457 if (NumArgs > 3)
5458 return Diag(TheCall->getEndLoc(),
5459 diag::err_typecheck_call_too_many_args_at_most)
5460 << 0 /*function call*/ << 3 << NumArgs << /*is non object*/ 0
5461 << TheCall->getSourceRange();
5462
5463 // Argument 0 is checked for us and the remaining arguments must be
5464 // constant integers.
5465 for (unsigned i = 1; i != NumArgs; ++i)
5466 if (BuiltinConstantArgRange(TheCall, ArgNum: i, Low: 0, High: i == 1 ? 1 : 3))
5467 return true;
5468
5469 return false;
5470}
5471
5472bool Sema::BuiltinArithmeticFence(CallExpr *TheCall) {
5473 if (!Context.getTargetInfo().checkArithmeticFenceSupported())
5474 return Diag(TheCall->getBeginLoc(), diag::err_builtin_target_unsupported)
5475 << SourceRange(TheCall->getBeginLoc(), TheCall->getEndLoc());
5476 if (checkArgCount(Call: TheCall, DesiredArgCount: 1))
5477 return true;
5478 Expr *Arg = TheCall->getArg(Arg: 0);
5479 if (Arg->isInstantiationDependent())
5480 return false;
5481
5482 QualType ArgTy = Arg->getType();
5483 if (!ArgTy->hasFloatingRepresentation())
5484 return Diag(TheCall->getEndLoc(), diag::err_typecheck_expect_flt_or_vector)
5485 << ArgTy;
5486 if (Arg->isLValue()) {
5487 ExprResult FirstArg = DefaultLvalueConversion(E: Arg);
5488 TheCall->setArg(Arg: 0, ArgExpr: FirstArg.get());
5489 }
5490 TheCall->setType(TheCall->getArg(Arg: 0)->getType());
5491 return false;
5492}
5493
5494bool Sema::BuiltinAssume(CallExpr *TheCall) {
5495 Expr *Arg = TheCall->getArg(Arg: 0);
5496 if (Arg->isInstantiationDependent()) return false;
5497
5498 if (Arg->HasSideEffects(Context))
5499 Diag(Arg->getBeginLoc(), diag::warn_assume_side_effects)
5500 << Arg->getSourceRange()
5501 << cast<FunctionDecl>(TheCall->getCalleeDecl())->getIdentifier();
5502
5503 return false;
5504}
5505
5506bool Sema::BuiltinAllocaWithAlign(CallExpr *TheCall) {
5507 // The alignment must be a constant integer.
5508 Expr *Arg = TheCall->getArg(Arg: 1);
5509
5510 // We can't check the value of a dependent argument.
5511 if (!Arg->isTypeDependent() && !Arg->isValueDependent()) {
5512 if (const auto *UE =
5513 dyn_cast<UnaryExprOrTypeTraitExpr>(Arg->IgnoreParenImpCasts()))
5514 if (UE->getKind() == UETT_AlignOf ||
5515 UE->getKind() == UETT_PreferredAlignOf)
5516 Diag(TheCall->getBeginLoc(), diag::warn_alloca_align_alignof)
5517 << Arg->getSourceRange();
5518
5519 llvm::APSInt Result = Arg->EvaluateKnownConstInt(Ctx: Context);
5520
5521 if (!Result.isPowerOf2())
5522 return Diag(TheCall->getBeginLoc(), diag::err_alignment_not_power_of_two)
5523 << Arg->getSourceRange();
5524
5525 if (Result < Context.getCharWidth())
5526 return Diag(TheCall->getBeginLoc(), diag::err_alignment_too_small)
5527 << (unsigned)Context.getCharWidth() << Arg->getSourceRange();
5528
5529 if (Result > std::numeric_limits<int32_t>::max())
5530 return Diag(TheCall->getBeginLoc(), diag::err_alignment_too_big)
5531 << std::numeric_limits<int32_t>::max() << Arg->getSourceRange();
5532 }
5533
5534 return false;
5535}
5536
5537bool Sema::BuiltinAssumeAligned(CallExpr *TheCall) {
5538 if (checkArgCountRange(Call: TheCall, MinArgCount: 2, MaxArgCount: 3))
5539 return true;
5540
5541 unsigned NumArgs = TheCall->getNumArgs();
5542 Expr *FirstArg = TheCall->getArg(Arg: 0);
5543
5544 {
5545 ExprResult FirstArgResult =
5546 DefaultFunctionArrayLvalueConversion(E: FirstArg);
5547 if (!FirstArgResult.get()->getType()->isPointerType()) {
5548 Diag(TheCall->getBeginLoc(), diag::err_builtin_assume_aligned_invalid_arg)
5549 << TheCall->getSourceRange();
5550 return true;
5551 }
5552 TheCall->setArg(Arg: 0, ArgExpr: FirstArgResult.get());
5553 }
5554
5555 // The alignment must be a constant integer.
5556 Expr *SecondArg = TheCall->getArg(Arg: 1);
5557
5558 // We can't check the value of a dependent argument.
5559 if (!SecondArg->isValueDependent()) {
5560 llvm::APSInt Result;
5561 if (BuiltinConstantArg(TheCall, ArgNum: 1, Result))
5562 return true;
5563
5564 if (!Result.isPowerOf2())
5565 return Diag(TheCall->getBeginLoc(), diag::err_alignment_not_power_of_two)
5566 << SecondArg->getSourceRange();
5567
5568 if (Result > Sema::MaximumAlignment)
5569 Diag(TheCall->getBeginLoc(), diag::warn_assume_aligned_too_great)
5570 << SecondArg->getSourceRange() << Sema::MaximumAlignment;
5571 }
5572
5573 if (NumArgs > 2) {
5574 Expr *ThirdArg = TheCall->getArg(Arg: 2);
5575 if (convertArgumentToType(S&: *this, Value&: ThirdArg, Ty: Context.getSizeType()))
5576 return true;
5577 TheCall->setArg(Arg: 2, ArgExpr: ThirdArg);
5578 }
5579
5580 return false;
5581}
5582
5583bool Sema::BuiltinOSLogFormat(CallExpr *TheCall) {
5584 unsigned BuiltinID =
5585 cast<FunctionDecl>(Val: TheCall->getCalleeDecl())->getBuiltinID();
5586 bool IsSizeCall = BuiltinID == Builtin::BI__builtin_os_log_format_buffer_size;
5587
5588 unsigned NumArgs = TheCall->getNumArgs();
5589 unsigned NumRequiredArgs = IsSizeCall ? 1 : 2;
5590 if (NumArgs < NumRequiredArgs) {
5591 return Diag(TheCall->getEndLoc(), diag::err_typecheck_call_too_few_args)
5592 << 0 /* function call */ << NumRequiredArgs << NumArgs
5593 << /*is non object*/ 0 << TheCall->getSourceRange();
5594 }
5595 if (NumArgs >= NumRequiredArgs + 0x100) {
5596 return Diag(TheCall->getEndLoc(),
5597 diag::err_typecheck_call_too_many_args_at_most)
5598 << 0 /* function call */ << (NumRequiredArgs + 0xff) << NumArgs
5599 << /*is non object*/ 0 << TheCall->getSourceRange();
5600 }
5601 unsigned i = 0;
5602
5603 // For formatting call, check buffer arg.
5604 if (!IsSizeCall) {
5605 ExprResult Arg(TheCall->getArg(Arg: i));
5606 InitializedEntity Entity = InitializedEntity::InitializeParameter(
5607 Context, Context.VoidPtrTy, false);
5608 Arg = PerformCopyInitialization(Entity, EqualLoc: SourceLocation(), Init: Arg);
5609 if (Arg.isInvalid())
5610 return true;
5611 TheCall->setArg(Arg: i, ArgExpr: Arg.get());
5612 i++;
5613 }
5614
5615 // Check string literal arg.
5616 unsigned FormatIdx = i;
5617 {
5618 ExprResult Arg = CheckOSLogFormatStringArg(Arg: TheCall->getArg(Arg: i));
5619 if (Arg.isInvalid())
5620 return true;
5621 TheCall->setArg(Arg: i, ArgExpr: Arg.get());
5622 i++;
5623 }
5624
5625 // Make sure variadic args are scalar.
5626 unsigned FirstDataArg = i;
5627 while (i < NumArgs) {
5628 ExprResult Arg = DefaultVariadicArgumentPromotion(
5629 E: TheCall->getArg(Arg: i), CT: VariadicCallType::Function, FDecl: nullptr);
5630 if (Arg.isInvalid())
5631 return true;
5632 CharUnits ArgSize = Context.getTypeSizeInChars(T: Arg.get()->getType());
5633 if (ArgSize.getQuantity() >= 0x100) {
5634 return Diag(Arg.get()->getEndLoc(), diag::err_os_log_argument_too_big)
5635 << i << (int)ArgSize.getQuantity() << 0xff
5636 << TheCall->getSourceRange();
5637 }
5638 TheCall->setArg(Arg: i, ArgExpr: Arg.get());
5639 i++;
5640 }
5641
5642 // Check formatting specifiers. NOTE: We're only doing this for the non-size
5643 // call to avoid duplicate diagnostics.
5644 if (!IsSizeCall) {
5645 llvm::SmallBitVector CheckedVarArgs(NumArgs, false);
5646 ArrayRef<const Expr *> Args(TheCall->getArgs(), TheCall->getNumArgs());
5647 bool Success = CheckFormatArguments(
5648 Args, FAPK: FAPK_Variadic, ReferenceFormatString: nullptr, format_idx: FormatIdx, firstDataArg: FirstDataArg,
5649 Type: FormatStringType::OSLog, CallType: VariadicCallType::Function,
5650 Loc: TheCall->getBeginLoc(), range: SourceRange(), CheckedVarArgs);
5651 if (!Success)
5652 return true;
5653 }
5654
5655 if (IsSizeCall) {
5656 TheCall->setType(Context.getSizeType());
5657 } else {
5658 TheCall->setType(Context.VoidPtrTy);
5659 }
5660 return false;
5661}
5662
5663bool Sema::BuiltinConstantArg(CallExpr *TheCall, int ArgNum,
5664 llvm::APSInt &Result) {
5665 Expr *Arg = TheCall->getArg(Arg: ArgNum);
5666 DeclRefExpr *DRE =cast<DeclRefExpr>(Val: TheCall->getCallee()->IgnoreParenCasts());
5667 FunctionDecl *FDecl = cast<FunctionDecl>(Val: DRE->getDecl());
5668
5669 if (Arg->isTypeDependent() || Arg->isValueDependent()) return false;
5670
5671 std::optional<llvm::APSInt> R;
5672 if (!(R = Arg->getIntegerConstantExpr(Context)))
5673 return Diag(TheCall->getBeginLoc(), diag::err_constant_integer_arg_type)
5674 << FDecl->getDeclName() << Arg->getSourceRange();
5675 Result = *R;
5676 return false;
5677}
5678
5679bool Sema::BuiltinConstantArgRange(CallExpr *TheCall, int ArgNum, int Low,
5680 int High, bool RangeIsError) {
5681 if (isConstantEvaluatedContext())
5682 return false;
5683 llvm::APSInt Result;
5684
5685 // We can't check the value of a dependent argument.
5686 Expr *Arg = TheCall->getArg(Arg: ArgNum);
5687 if (Arg->isTypeDependent() || Arg->isValueDependent())
5688 return false;
5689
5690 // Check constant-ness first.
5691 if (BuiltinConstantArg(TheCall, ArgNum, Result))
5692 return true;
5693
5694 if (Result.getSExtValue() < Low || Result.getSExtValue() > High) {
5695 if (RangeIsError)
5696 return Diag(TheCall->getBeginLoc(), diag::err_argument_invalid_range)
5697 << toString(Result, 10) << Low << High << Arg->getSourceRange();
5698 else
5699 // Defer the warning until we know if the code will be emitted so that
5700 // dead code can ignore this.
5701 DiagRuntimeBehavior(TheCall->getBeginLoc(), TheCall,
5702 PDiag(diag::warn_argument_invalid_range)
5703 << toString(Result, 10) << Low << High
5704 << Arg->getSourceRange());
5705 }
5706
5707 return false;
5708}
5709
5710bool Sema::BuiltinConstantArgMultiple(CallExpr *TheCall, int ArgNum,
5711 unsigned Num) {
5712 llvm::APSInt Result;
5713
5714 // We can't check the value of a dependent argument.
5715 Expr *Arg = TheCall->getArg(Arg: ArgNum);
5716 if (Arg->isTypeDependent() || Arg->isValueDependent())
5717 return false;
5718
5719 // Check constant-ness first.
5720 if (BuiltinConstantArg(TheCall, ArgNum, Result))
5721 return true;
5722
5723 if (Result.getSExtValue() % Num != 0)
5724 return Diag(TheCall->getBeginLoc(), diag::err_argument_not_multiple)
5725 << Num << Arg->getSourceRange();
5726
5727 return false;
5728}
5729
5730bool Sema::BuiltinConstantArgPower2(CallExpr *TheCall, int ArgNum) {
5731 llvm::APSInt Result;
5732
5733 // We can't check the value of a dependent argument.
5734 Expr *Arg = TheCall->getArg(Arg: ArgNum);
5735 if (Arg->isTypeDependent() || Arg->isValueDependent())
5736 return false;
5737
5738 // Check constant-ness first.
5739 if (BuiltinConstantArg(TheCall, ArgNum, Result))
5740 return true;
5741
5742 // Bit-twiddling to test for a power of 2: for x > 0, x & (x-1) is zero if
5743 // and only if x is a power of 2.
5744 if (Result.isStrictlyPositive() && (Result & (Result - 1)) == 0)
5745 return false;
5746
5747 return Diag(TheCall->getBeginLoc(), diag::err_argument_not_power_of_2)
5748 << Arg->getSourceRange();
5749}
5750
5751static bool IsShiftedByte(llvm::APSInt Value) {
5752 if (Value.isNegative())
5753 return false;
5754
5755 // Check if it's a shifted byte, by shifting it down
5756 while (true) {
5757 // If the value fits in the bottom byte, the check passes.
5758 if (Value < 0x100)
5759 return true;
5760
5761 // Otherwise, if the value has _any_ bits in the bottom byte, the check
5762 // fails.
5763 if ((Value & 0xFF) != 0)
5764 return false;
5765
5766 // If the bottom 8 bits are all 0, but something above that is nonzero,
5767 // then shifting the value right by 8 bits won't affect whether it's a
5768 // shifted byte or not. So do that, and go round again.
5769 Value >>= 8;
5770 }
5771}
5772
5773bool Sema::BuiltinConstantArgShiftedByte(CallExpr *TheCall, int ArgNum,
5774 unsigned ArgBits) {
5775 llvm::APSInt Result;
5776
5777 // We can't check the value of a dependent argument.
5778 Expr *Arg = TheCall->getArg(Arg: ArgNum);
5779 if (Arg->isTypeDependent() || Arg->isValueDependent())
5780 return false;
5781
5782 // Check constant-ness first.
5783 if (BuiltinConstantArg(TheCall, ArgNum, Result))
5784 return true;
5785
5786 // Truncate to the given size.
5787 Result = Result.getLoBits(numBits: ArgBits);
5788 Result.setIsUnsigned(true);
5789
5790 if (IsShiftedByte(Value: Result))
5791 return false;
5792
5793 return Diag(TheCall->getBeginLoc(), diag::err_argument_not_shifted_byte)
5794 << Arg->getSourceRange();
5795}
5796
5797bool Sema::BuiltinConstantArgShiftedByteOrXXFF(CallExpr *TheCall, int ArgNum,
5798 unsigned ArgBits) {
5799 llvm::APSInt Result;
5800
5801 // We can't check the value of a dependent argument.
5802 Expr *Arg = TheCall->getArg(Arg: ArgNum);
5803 if (Arg->isTypeDependent() || Arg->isValueDependent())
5804 return false;
5805
5806 // Check constant-ness first.
5807 if (BuiltinConstantArg(TheCall, ArgNum, Result))
5808 return true;
5809
5810 // Truncate to the given size.
5811 Result = Result.getLoBits(numBits: ArgBits);
5812 Result.setIsUnsigned(true);
5813
5814 // Check to see if it's in either of the required forms.
5815 if (IsShiftedByte(Value: Result) ||
5816 (Result > 0 && Result < 0x10000 && (Result & 0xFF) == 0xFF))
5817 return false;
5818
5819 return Diag(TheCall->getBeginLoc(),
5820 diag::err_argument_not_shifted_byte_or_xxff)
5821 << Arg->getSourceRange();
5822}
5823
5824bool Sema::BuiltinLongjmp(CallExpr *TheCall) {
5825 if (!Context.getTargetInfo().hasSjLjLowering())
5826 return Diag(TheCall->getBeginLoc(), diag::err_builtin_longjmp_unsupported)
5827 << SourceRange(TheCall->getBeginLoc(), TheCall->getEndLoc());
5828
5829 Expr *Arg = TheCall->getArg(Arg: 1);
5830 llvm::APSInt Result;
5831
5832 // TODO: This is less than ideal. Overload this to take a value.
5833 if (BuiltinConstantArg(TheCall, ArgNum: 1, Result))
5834 return true;
5835
5836 if (Result != 1)
5837 return Diag(TheCall->getBeginLoc(), diag::err_builtin_longjmp_invalid_val)
5838 << SourceRange(Arg->getBeginLoc(), Arg->getEndLoc());
5839
5840 return false;
5841}
5842
5843bool Sema::BuiltinSetjmp(CallExpr *TheCall) {
5844 if (!Context.getTargetInfo().hasSjLjLowering())
5845 return Diag(TheCall->getBeginLoc(), diag::err_builtin_setjmp_unsupported)
5846 << SourceRange(TheCall->getBeginLoc(), TheCall->getEndLoc());
5847 return false;
5848}
5849
5850bool Sema::BuiltinCountedByRef(CallExpr *TheCall) {
5851 if (checkArgCount(Call: TheCall, DesiredArgCount: 1))
5852 return true;
5853
5854 ExprResult ArgRes = UsualUnaryConversions(E: TheCall->getArg(Arg: 0));
5855 if (ArgRes.isInvalid())
5856 return true;
5857
5858 // For simplicity, we support only limited expressions for the argument.
5859 // Specifically a pointer to a flexible array member:'ptr->array'. This
5860 // allows us to reject arguments with complex casting, which really shouldn't
5861 // be a huge problem.
5862 const Expr *Arg = ArgRes.get()->IgnoreParenImpCasts();
5863 if (!isa<PointerType>(Arg->getType()) && !Arg->getType()->isArrayType())
5864 return Diag(Arg->getBeginLoc(),
5865 diag::err_builtin_counted_by_ref_must_be_flex_array_member)
5866 << Arg->getSourceRange();
5867
5868 if (Arg->HasSideEffects(Context))
5869 return Diag(Arg->getBeginLoc(),
5870 diag::err_builtin_counted_by_ref_has_side_effects)
5871 << Arg->getSourceRange();
5872
5873 if (const auto *ME = dyn_cast<MemberExpr>(Val: Arg)) {
5874 if (!ME->isFlexibleArrayMemberLike(
5875 Context, getLangOpts().getStrictFlexArraysLevel()))
5876 return Diag(Arg->getBeginLoc(),
5877 diag::err_builtin_counted_by_ref_must_be_flex_array_member)
5878 << Arg->getSourceRange();
5879
5880 if (auto *CATy =
5881 ME->getMemberDecl()->getType()->getAs<CountAttributedType>();
5882 CATy && CATy->getKind() == CountAttributedType::CountedBy) {
5883 const auto *FAMDecl = cast<FieldDecl>(Val: ME->getMemberDecl());
5884 if (const FieldDecl *CountFD = FAMDecl->findCountedByField()) {
5885 TheCall->setType(Context.getPointerType(CountFD->getType()));
5886 return false;
5887 }
5888 }
5889 } else {
5890 return Diag(Arg->getBeginLoc(),
5891 diag::err_builtin_counted_by_ref_must_be_flex_array_member)
5892 << Arg->getSourceRange();
5893 }
5894
5895 TheCall->setType(Context.getPointerType(Context.VoidTy));
5896 return false;
5897}
5898
5899/// The result of __builtin_counted_by_ref cannot be assigned to a variable.
5900/// It allows leaking and modification of bounds safety information.
5901bool Sema::CheckInvalidBuiltinCountedByRef(const Expr *E,
5902 BuiltinCountedByRefKind K) {
5903 const CallExpr *CE =
5904 E ? dyn_cast<CallExpr>(Val: E->IgnoreParenImpCasts()) : nullptr;
5905 if (!CE || CE->getBuiltinCallee() != Builtin::BI__builtin_counted_by_ref)
5906 return false;
5907
5908 switch (K) {
5909 case BuiltinCountedByRefKind::Assignment:
5910 case BuiltinCountedByRefKind::Initializer:
5911 Diag(E->getExprLoc(),
5912 diag::err_builtin_counted_by_ref_cannot_leak_reference)
5913 << 0 << E->getSourceRange();
5914 break;
5915 case BuiltinCountedByRefKind::FunctionArg:
5916 Diag(E->getExprLoc(),
5917 diag::err_builtin_counted_by_ref_cannot_leak_reference)
5918 << 1 << E->getSourceRange();
5919 break;
5920 case BuiltinCountedByRefKind::ReturnArg:
5921 Diag(E->getExprLoc(),
5922 diag::err_builtin_counted_by_ref_cannot_leak_reference)
5923 << 2 << E->getSourceRange();
5924 break;
5925 case BuiltinCountedByRefKind::ArraySubscript:
5926 Diag(E->getExprLoc(), diag::err_builtin_counted_by_ref_invalid_use)
5927 << 0 << E->getSourceRange();
5928 break;
5929 case BuiltinCountedByRefKind::BinaryExpr:
5930 Diag(E->getExprLoc(), diag::err_builtin_counted_by_ref_invalid_use)
5931 << 1 << E->getSourceRange();
5932 break;
5933 }
5934
5935 return true;
5936}
5937
5938namespace {
5939
5940class UncoveredArgHandler {
5941 enum { Unknown = -1, AllCovered = -2 };
5942
5943 signed FirstUncoveredArg = Unknown;
5944 SmallVector<const Expr *, 4> DiagnosticExprs;
5945
5946public:
5947 UncoveredArgHandler() = default;
5948
5949 bool hasUncoveredArg() const {
5950 return (FirstUncoveredArg >= 0);
5951 }
5952
5953 unsigned getUncoveredArg() const {
5954 assert(hasUncoveredArg() && "no uncovered argument");
5955 return FirstUncoveredArg;
5956 }
5957
5958 void setAllCovered() {
5959 // A string has been found with all arguments covered, so clear out
5960 // the diagnostics.
5961 DiagnosticExprs.clear();
5962 FirstUncoveredArg = AllCovered;
5963 }
5964
5965 void Update(signed NewFirstUncoveredArg, const Expr *StrExpr) {
5966 assert(NewFirstUncoveredArg >= 0 && "Outside range");
5967
5968 // Don't update if a previous string covers all arguments.
5969 if (FirstUncoveredArg == AllCovered)
5970 return;
5971
5972 // UncoveredArgHandler tracks the highest uncovered argument index
5973 // and with it all the strings that match this index.
5974 if (NewFirstUncoveredArg == FirstUncoveredArg)
5975 DiagnosticExprs.push_back(Elt: StrExpr);
5976 else if (NewFirstUncoveredArg > FirstUncoveredArg) {
5977 DiagnosticExprs.clear();
5978 DiagnosticExprs.push_back(Elt: StrExpr);
5979 FirstUncoveredArg = NewFirstUncoveredArg;
5980 }
5981 }
5982
5983 void Diagnose(Sema &S, bool IsFunctionCall, const Expr *ArgExpr);
5984};
5985
5986enum StringLiteralCheckType {
5987 SLCT_NotALiteral,
5988 SLCT_UncheckedLiteral,
5989 SLCT_CheckedLiteral
5990};
5991
5992} // namespace
5993
5994static void sumOffsets(llvm::APSInt &Offset, llvm::APSInt Addend,
5995 BinaryOperatorKind BinOpKind,
5996 bool AddendIsRight) {
5997 unsigned BitWidth = Offset.getBitWidth();
5998 unsigned AddendBitWidth = Addend.getBitWidth();
5999 // There might be negative interim results.
6000 if (Addend.isUnsigned()) {
6001 Addend = Addend.zext(width: ++AddendBitWidth);
6002 Addend.setIsSigned(true);
6003 }
6004 // Adjust the bit width of the APSInts.
6005 if (AddendBitWidth > BitWidth) {
6006 Offset = Offset.sext(width: AddendBitWidth);
6007 BitWidth = AddendBitWidth;
6008 } else if (BitWidth > AddendBitWidth) {
6009 Addend = Addend.sext(width: BitWidth);
6010 }
6011
6012 bool Ov = false;
6013 llvm::APSInt ResOffset = Offset;
6014 if (BinOpKind == BO_Add)
6015 ResOffset = Offset.sadd_ov(RHS: Addend, Overflow&: Ov);
6016 else {
6017 assert(AddendIsRight && BinOpKind == BO_Sub &&
6018 "operator must be add or sub with addend on the right");
6019 ResOffset = Offset.ssub_ov(RHS: Addend, Overflow&: Ov);
6020 }
6021
6022 // We add an offset to a pointer here so we should support an offset as big as
6023 // possible.
6024 if (Ov) {
6025 assert(BitWidth <= std::numeric_limits<unsigned>::max() / 2 &&
6026 "index (intermediate) result too big");
6027 Offset = Offset.sext(width: 2 * BitWidth);
6028 sumOffsets(Offset, Addend, BinOpKind, AddendIsRight);
6029 return;
6030 }
6031
6032 Offset = ResOffset;
6033}
6034
6035namespace {
6036
6037// This is a wrapper class around StringLiteral to support offsetted string
6038// literals as format strings. It takes the offset into account when returning
6039// the string and its length or the source locations to display notes correctly.
6040class FormatStringLiteral {
6041 const StringLiteral *FExpr;
6042 int64_t Offset;
6043
6044public:
6045 FormatStringLiteral(const StringLiteral *fexpr, int64_t Offset = 0)
6046 : FExpr(fexpr), Offset(Offset) {}
6047
6048 const StringLiteral *getFormatString() const { return FExpr; }
6049
6050 StringRef getString() const { return FExpr->getString().drop_front(N: Offset); }
6051
6052 unsigned getByteLength() const {
6053 return FExpr->getByteLength() - getCharByteWidth() * Offset;
6054 }
6055
6056 unsigned getLength() const { return FExpr->getLength() - Offset; }
6057 unsigned getCharByteWidth() const { return FExpr->getCharByteWidth(); }
6058
6059 StringLiteralKind getKind() const { return FExpr->getKind(); }
6060
6061 QualType getType() const { return FExpr->getType(); }
6062
6063 bool isAscii() const { return FExpr->isOrdinary(); }
6064 bool isWide() const { return FExpr->isWide(); }
6065 bool isUTF8() const { return FExpr->isUTF8(); }
6066 bool isUTF16() const { return FExpr->isUTF16(); }
6067 bool isUTF32() const { return FExpr->isUTF32(); }
6068 bool isPascal() const { return FExpr->isPascal(); }
6069
6070 SourceLocation getLocationOfByte(
6071 unsigned ByteNo, const SourceManager &SM, const LangOptions &Features,
6072 const TargetInfo &Target, unsigned *StartToken = nullptr,
6073 unsigned *StartTokenByteOffset = nullptr) const {
6074 return FExpr->getLocationOfByte(ByteNo: ByteNo + Offset, SM, Features, Target,
6075 StartToken, StartTokenByteOffset);
6076 }
6077
6078 SourceLocation getBeginLoc() const LLVM_READONLY {
6079 return FExpr->getBeginLoc().getLocWithOffset(Offset);
6080 }
6081
6082 SourceLocation getEndLoc() const LLVM_READONLY { return FExpr->getEndLoc(); }
6083};
6084
6085} // namespace
6086
6087static void CheckFormatString(
6088 Sema &S, const FormatStringLiteral *FExpr,
6089 const StringLiteral *ReferenceFormatString, const Expr *OrigFormatExpr,
6090 ArrayRef<const Expr *> Args, Sema::FormatArgumentPassingKind APK,
6091 unsigned format_idx, unsigned firstDataArg, FormatStringType Type,
6092 bool inFunctionCall, VariadicCallType CallType,
6093 llvm::SmallBitVector &CheckedVarArgs, UncoveredArgHandler &UncoveredArg,
6094 bool IgnoreStringsWithoutSpecifiers);
6095
6096static const Expr *maybeConstEvalStringLiteral(ASTContext &Context,
6097 const Expr *E);
6098
6099// Determine if an expression is a string literal or constant string.
6100// If this function returns false on the arguments to a function expecting a
6101// format string, we will usually need to emit a warning.
6102// True string literals are then checked by CheckFormatString.
6103static StringLiteralCheckType checkFormatStringExpr(
6104 Sema &S, const StringLiteral *ReferenceFormatString, const Expr *E,
6105 ArrayRef<const Expr *> Args, Sema::FormatArgumentPassingKind APK,
6106 unsigned format_idx, unsigned firstDataArg, FormatStringType Type,
6107 VariadicCallType CallType, bool InFunctionCall,
6108 llvm::SmallBitVector &CheckedVarArgs, UncoveredArgHandler &UncoveredArg,
6109 llvm::APSInt Offset, bool IgnoreStringsWithoutSpecifiers = false) {
6110 if (S.isConstantEvaluatedContext())
6111 return SLCT_NotALiteral;
6112tryAgain:
6113 assert(Offset.isSigned() && "invalid offset");
6114
6115 if (E->isTypeDependent() || E->isValueDependent())
6116 return SLCT_NotALiteral;
6117
6118 E = E->IgnoreParenCasts();
6119
6120 if (E->isNullPointerConstant(Ctx&: S.Context, NPC: Expr::NPC_ValueDependentIsNotNull))
6121 // Technically -Wformat-nonliteral does not warn about this case.
6122 // The behavior of printf and friends in this case is implementation
6123 // dependent. Ideally if the format string cannot be null then
6124 // it should have a 'nonnull' attribute in the function prototype.
6125 return SLCT_UncheckedLiteral;
6126
6127 switch (E->getStmtClass()) {
6128 case Stmt::InitListExprClass:
6129 // Handle expressions like {"foobar"}.
6130 if (const clang::Expr *SLE = maybeConstEvalStringLiteral(Context&: S.Context, E)) {
6131 return checkFormatStringExpr(
6132 S, ReferenceFormatString, E: SLE, Args, APK, format_idx, firstDataArg,
6133 Type, CallType, /*InFunctionCall*/ false, CheckedVarArgs,
6134 UncoveredArg, Offset, IgnoreStringsWithoutSpecifiers);
6135 }
6136 return SLCT_NotALiteral;
6137 case Stmt::BinaryConditionalOperatorClass:
6138 case Stmt::ConditionalOperatorClass: {
6139 // The expression is a literal if both sub-expressions were, and it was
6140 // completely checked only if both sub-expressions were checked.
6141 const AbstractConditionalOperator *C =
6142 cast<AbstractConditionalOperator>(Val: E);
6143
6144 // Determine whether it is necessary to check both sub-expressions, for
6145 // example, because the condition expression is a constant that can be
6146 // evaluated at compile time.
6147 bool CheckLeft = true, CheckRight = true;
6148
6149 bool Cond;
6150 if (C->getCond()->EvaluateAsBooleanCondition(
6151 Result&: Cond, Ctx: S.getASTContext(), InConstantContext: S.isConstantEvaluatedContext())) {
6152 if (Cond)
6153 CheckRight = false;
6154 else
6155 CheckLeft = false;
6156 }
6157
6158 // We need to maintain the offsets for the right and the left hand side
6159 // separately to check if every possible indexed expression is a valid
6160 // string literal. They might have different offsets for different string
6161 // literals in the end.
6162 StringLiteralCheckType Left;
6163 if (!CheckLeft)
6164 Left = SLCT_UncheckedLiteral;
6165 else {
6166 Left = checkFormatStringExpr(
6167 S, ReferenceFormatString, E: C->getTrueExpr(), Args, APK, format_idx,
6168 firstDataArg, Type, CallType, InFunctionCall, CheckedVarArgs,
6169 UncoveredArg, Offset, IgnoreStringsWithoutSpecifiers);
6170 if (Left == SLCT_NotALiteral || !CheckRight) {
6171 return Left;
6172 }
6173 }
6174
6175 StringLiteralCheckType Right = checkFormatStringExpr(
6176 S, ReferenceFormatString, E: C->getFalseExpr(), Args, APK, format_idx,
6177 firstDataArg, Type, CallType, InFunctionCall, CheckedVarArgs,
6178 UncoveredArg, Offset, IgnoreStringsWithoutSpecifiers);
6179
6180 return (CheckLeft && Left < Right) ? Left : Right;
6181 }
6182
6183 case Stmt::ImplicitCastExprClass:
6184 E = cast<ImplicitCastExpr>(Val: E)->getSubExpr();
6185 goto tryAgain;
6186
6187 case Stmt::OpaqueValueExprClass:
6188 if (const Expr *src = cast<OpaqueValueExpr>(Val: E)->getSourceExpr()) {
6189 E = src;
6190 goto tryAgain;
6191 }
6192 return SLCT_NotALiteral;
6193
6194 case Stmt::PredefinedExprClass:
6195 // While __func__, etc., are technically not string literals, they
6196 // cannot contain format specifiers and thus are not a security
6197 // liability.
6198 return SLCT_UncheckedLiteral;
6199
6200 case Stmt::DeclRefExprClass: {
6201 const DeclRefExpr *DR = cast<DeclRefExpr>(Val: E);
6202
6203 // As an exception, do not flag errors for variables binding to
6204 // const string literals.
6205 if (const VarDecl *VD = dyn_cast<VarDecl>(Val: DR->getDecl())) {
6206 bool isConstant = false;
6207 QualType T = DR->getType();
6208
6209 if (const ArrayType *AT = S.Context.getAsArrayType(T)) {
6210 isConstant = AT->getElementType().isConstant(Ctx: S.Context);
6211 } else if (const PointerType *PT = T->getAs<PointerType>()) {
6212 isConstant = T.isConstant(Ctx: S.Context) &&
6213 PT->getPointeeType().isConstant(Ctx: S.Context);
6214 } else if (T->isObjCObjectPointerType()) {
6215 // In ObjC, there is usually no "const ObjectPointer" type,
6216 // so don't check if the pointee type is constant.
6217 isConstant = T.isConstant(Ctx: S.Context);
6218 }
6219
6220 if (isConstant) {
6221 if (const Expr *Init = VD->getAnyInitializer()) {
6222 // Look through initializers like const char c[] = { "foo" }
6223 if (const InitListExpr *InitList = dyn_cast<InitListExpr>(Val: Init)) {
6224 if (InitList->isStringLiteralInit())
6225 Init = InitList->getInit(Init: 0)->IgnoreParenImpCasts();
6226 }
6227 return checkFormatStringExpr(
6228 S, ReferenceFormatString, E: Init, Args, APK, format_idx,
6229 firstDataArg, Type, CallType,
6230 /*InFunctionCall*/ false, CheckedVarArgs, UncoveredArg, Offset);
6231 }
6232 }
6233
6234 // When the format argument is an argument of this function, and this
6235 // function also has the format attribute, there are several interactions
6236 // for which there shouldn't be a warning. For instance, when calling
6237 // v*printf from a function that has the printf format attribute, we
6238 // should not emit a warning about using `fmt`, even though it's not
6239 // constant, because the arguments have already been checked for the
6240 // caller of `logmessage`:
6241 //
6242 // __attribute__((format(printf, 1, 2)))
6243 // void logmessage(char const *fmt, ...) {
6244 // va_list ap;
6245 // va_start(ap, fmt);
6246 // vprintf(fmt, ap); /* do not emit a warning about "fmt" */
6247 // ...
6248 // }
6249 //
6250 // Another interaction that we need to support is using a format string
6251 // specified by the format_matches attribute:
6252 //
6253 // __attribute__((format_matches(printf, 1, "%s %d")))
6254 // void logmessage(char const *fmt, const char *a, int b) {
6255 // printf(fmt, a, b); /* do not emit a warning about "fmt" */
6256 // printf(fmt, 123.4); /* emit warnings that "%s %d" is incompatible */
6257 // ...
6258 // }
6259 //
6260 // Yet another interaction that we need to support is calling a variadic
6261 // format function from a format function that has fixed arguments. For
6262 // instance:
6263 //
6264 // __attribute__((format(printf, 1, 2)))
6265 // void logstring(char const *fmt, char const *str) {
6266 // printf(fmt, str); /* do not emit a warning about "fmt" */
6267 // }
6268 //
6269 // Same (and perhaps more relatably) for the variadic template case:
6270 //
6271 // template<typename... Args>
6272 // __attribute__((format(printf, 1, 2)))
6273 // void log(const char *fmt, Args&&... args) {
6274 // printf(fmt, forward<Args>(args)...);
6275 // /* do not emit a warning about "fmt" */
6276 // }
6277 //
6278 // Due to implementation difficulty, we only check the format, not the
6279 // format arguments, in all cases.
6280 //
6281 if (const auto *PV = dyn_cast<ParmVarDecl>(Val: VD)) {
6282 if (const auto *D = dyn_cast<Decl>(PV->getDeclContext())) {
6283 for (const auto *PVFormatMatches :
6284 D->specific_attrs<FormatMatchesAttr>()) {
6285 Sema::FormatStringInfo CalleeFSI;
6286 if (!Sema::getFormatStringInfo(D, PVFormatMatches->getFormatIdx(),
6287 0, &CalleeFSI))
6288 continue;
6289 if (PV->getFunctionScopeIndex() == CalleeFSI.FormatIdx) {
6290 // If using the wrong type of format string, emit a diagnostic
6291 // here and stop checking to avoid irrelevant diagnostics.
6292 if (Type != S.GetFormatStringType(PVFormatMatches)) {
6293 S.Diag(Args[format_idx]->getBeginLoc(),
6294 diag::warn_format_string_type_incompatible)
6295 << PVFormatMatches->getType()->getName()
6296 << S.GetFormatStringTypeName(Type);
6297 if (!InFunctionCall) {
6298 S.Diag(PVFormatMatches->getFormatString()->getBeginLoc(),
6299 diag::note_format_string_defined);
6300 }
6301 return SLCT_UncheckedLiteral;
6302 }
6303 return checkFormatStringExpr(
6304 S, ReferenceFormatString, PVFormatMatches->getFormatString(),
6305 Args, APK, format_idx, firstDataArg, Type, CallType,
6306 /*InFunctionCall*/ false, CheckedVarArgs, UncoveredArg,
6307 Offset, IgnoreStringsWithoutSpecifiers);
6308 }
6309 }
6310
6311 for (const auto *PVFormat : D->specific_attrs<FormatAttr>()) {
6312 Sema::FormatStringInfo CallerFSI;
6313 if (!Sema::getFormatStringInfo(D, PVFormat->getFormatIdx(),
6314 PVFormat->getFirstArg(), &CallerFSI))
6315 continue;
6316 if (PV->getFunctionScopeIndex() == CallerFSI.FormatIdx) {
6317 // We also check if the formats are compatible.
6318 // We can't pass a 'scanf' string to a 'printf' function.
6319 if (Type != S.GetFormatStringType(PVFormat)) {
6320 S.Diag(Args[format_idx]->getBeginLoc(),
6321 diag::warn_format_string_type_incompatible)
6322 << PVFormat->getType()->getName()
6323 << S.GetFormatStringTypeName(Type);
6324 if (!InFunctionCall) {
6325 S.Diag(E->getBeginLoc(), diag::note_format_string_defined);
6326 }
6327 return SLCT_UncheckedLiteral;
6328 }
6329 // Lastly, check that argument passing kinds transition in a
6330 // way that makes sense:
6331 // from a caller with FAPK_VAList, allow FAPK_VAList
6332 // from a caller with FAPK_Fixed, allow FAPK_Fixed
6333 // from a caller with FAPK_Fixed, allow FAPK_Variadic
6334 // from a caller with FAPK_Variadic, allow FAPK_VAList
6335 switch (combineFAPK(CallerFSI.ArgPassingKind, APK)) {
6336 case combineFAPK(Sema::FAPK_VAList, Sema::FAPK_VAList):
6337 case combineFAPK(Sema::FAPK_Fixed, Sema::FAPK_Fixed):
6338 case combineFAPK(Sema::FAPK_Fixed, Sema::FAPK_Variadic):
6339 case combineFAPK(Sema::FAPK_Variadic, Sema::FAPK_VAList):
6340 return SLCT_UncheckedLiteral;
6341 }
6342 }
6343 }
6344 }
6345 }
6346 }
6347
6348 return SLCT_NotALiteral;
6349 }
6350
6351 case Stmt::CallExprClass:
6352 case Stmt::CXXMemberCallExprClass: {
6353 const CallExpr *CE = cast<CallExpr>(Val: E);
6354 if (const NamedDecl *ND = dyn_cast_or_null<NamedDecl>(Val: CE->getCalleeDecl())) {
6355 bool IsFirst = true;
6356 StringLiteralCheckType CommonResult;
6357 for (const auto *FA : ND->specific_attrs<FormatArgAttr>()) {
6358 const Expr *Arg = CE->getArg(FA->getFormatIdx().getASTIndex());
6359 StringLiteralCheckType Result = checkFormatStringExpr(
6360 S, ReferenceFormatString, Arg, Args, APK, format_idx, firstDataArg,
6361 Type, CallType, InFunctionCall, CheckedVarArgs, UncoveredArg,
6362 Offset, IgnoreStringsWithoutSpecifiers);
6363 if (IsFirst) {
6364 CommonResult = Result;
6365 IsFirst = false;
6366 }
6367 }
6368 if (!IsFirst)
6369 return CommonResult;
6370
6371 if (const auto *FD = dyn_cast<FunctionDecl>(Val: ND)) {
6372 unsigned BuiltinID = FD->getBuiltinID();
6373 if (BuiltinID == Builtin::BI__builtin___CFStringMakeConstantString ||
6374 BuiltinID == Builtin::BI__builtin___NSStringMakeConstantString) {
6375 const Expr *Arg = CE->getArg(Arg: 0);
6376 return checkFormatStringExpr(
6377 S, ReferenceFormatString, E: Arg, Args, APK, format_idx,
6378 firstDataArg, Type, CallType, InFunctionCall, CheckedVarArgs,
6379 UncoveredArg, Offset, IgnoreStringsWithoutSpecifiers);
6380 }
6381 }
6382 }
6383 if (const Expr *SLE = maybeConstEvalStringLiteral(Context&: S.Context, E))
6384 return checkFormatStringExpr(
6385 S, ReferenceFormatString, E: SLE, Args, APK, format_idx, firstDataArg,
6386 Type, CallType, /*InFunctionCall*/ false, CheckedVarArgs,
6387 UncoveredArg, Offset, IgnoreStringsWithoutSpecifiers);
6388 return SLCT_NotALiteral;
6389 }
6390 case Stmt::ObjCMessageExprClass: {
6391 const auto *ME = cast<ObjCMessageExpr>(Val: E);
6392 if (const auto *MD = ME->getMethodDecl()) {
6393 if (const auto *FA = MD->getAttr<FormatArgAttr>()) {
6394 // As a special case heuristic, if we're using the method -[NSBundle
6395 // localizedStringForKey:value:table:], ignore any key strings that lack
6396 // format specifiers. The idea is that if the key doesn't have any
6397 // format specifiers then its probably just a key to map to the
6398 // localized strings. If it does have format specifiers though, then its
6399 // likely that the text of the key is the format string in the
6400 // programmer's language, and should be checked.
6401 const ObjCInterfaceDecl *IFace;
6402 if (MD->isInstanceMethod() && (IFace = MD->getClassInterface()) &&
6403 IFace->getIdentifier()->isStr("NSBundle") &&
6404 MD->getSelector().isKeywordSelector(
6405 Names: {"localizedStringForKey", "value", "table"})) {
6406 IgnoreStringsWithoutSpecifiers = true;
6407 }
6408
6409 const Expr *Arg = ME->getArg(FA->getFormatIdx().getASTIndex());
6410 return checkFormatStringExpr(
6411 S, ReferenceFormatString, E: Arg, Args, APK, format_idx, firstDataArg,
6412 Type, CallType, InFunctionCall, CheckedVarArgs, UncoveredArg,
6413 Offset, IgnoreStringsWithoutSpecifiers);
6414 }
6415 }
6416
6417 return SLCT_NotALiteral;
6418 }
6419 case Stmt::ObjCStringLiteralClass:
6420 case Stmt::StringLiteralClass: {
6421 const StringLiteral *StrE = nullptr;
6422
6423 if (const ObjCStringLiteral *ObjCFExpr = dyn_cast<ObjCStringLiteral>(Val: E))
6424 StrE = ObjCFExpr->getString();
6425 else
6426 StrE = cast<StringLiteral>(Val: E);
6427
6428 if (StrE) {
6429 if (Offset.isNegative() || Offset > StrE->getLength()) {
6430 // TODO: It would be better to have an explicit warning for out of
6431 // bounds literals.
6432 return SLCT_NotALiteral;
6433 }
6434 FormatStringLiteral FStr(StrE, Offset.sextOrTrunc(width: 64).getSExtValue());
6435 CheckFormatString(S, FExpr: &FStr, ReferenceFormatString, OrigFormatExpr: E, Args, APK,
6436 format_idx, firstDataArg, Type, inFunctionCall: InFunctionCall,
6437 CallType, CheckedVarArgs, UncoveredArg,
6438 IgnoreStringsWithoutSpecifiers);
6439 return SLCT_CheckedLiteral;
6440 }
6441
6442 return SLCT_NotALiteral;
6443 }
6444 case Stmt::BinaryOperatorClass: {
6445 const BinaryOperator *BinOp = cast<BinaryOperator>(Val: E);
6446
6447 // A string literal + an int offset is still a string literal.
6448 if (BinOp->isAdditiveOp()) {
6449 Expr::EvalResult LResult, RResult;
6450
6451 bool LIsInt = BinOp->getLHS()->EvaluateAsInt(
6452 Result&: LResult, Ctx: S.Context, AllowSideEffects: Expr::SE_NoSideEffects,
6453 InConstantContext: S.isConstantEvaluatedContext());
6454 bool RIsInt = BinOp->getRHS()->EvaluateAsInt(
6455 Result&: RResult, Ctx: S.Context, AllowSideEffects: Expr::SE_NoSideEffects,
6456 InConstantContext: S.isConstantEvaluatedContext());
6457
6458 if (LIsInt != RIsInt) {
6459 BinaryOperatorKind BinOpKind = BinOp->getOpcode();
6460
6461 if (LIsInt) {
6462 if (BinOpKind == BO_Add) {
6463 sumOffsets(Offset, Addend: LResult.Val.getInt(), BinOpKind, AddendIsRight: RIsInt);
6464 E = BinOp->getRHS();
6465 goto tryAgain;
6466 }
6467 } else {
6468 sumOffsets(Offset, Addend: RResult.Val.getInt(), BinOpKind, AddendIsRight: RIsInt);
6469 E = BinOp->getLHS();
6470 goto tryAgain;
6471 }
6472 }
6473 }
6474
6475 return SLCT_NotALiteral;
6476 }
6477 case Stmt::UnaryOperatorClass: {
6478 const UnaryOperator *UnaOp = cast<UnaryOperator>(Val: E);
6479 auto ASE = dyn_cast<ArraySubscriptExpr>(Val: UnaOp->getSubExpr());
6480 if (UnaOp->getOpcode() == UO_AddrOf && ASE) {
6481 Expr::EvalResult IndexResult;
6482 if (ASE->getRHS()->EvaluateAsInt(Result&: IndexResult, Ctx: S.Context,
6483 AllowSideEffects: Expr::SE_NoSideEffects,
6484 InConstantContext: S.isConstantEvaluatedContext())) {
6485 sumOffsets(Offset, Addend: IndexResult.Val.getInt(), BinOpKind: BO_Add,
6486 /*RHS is int*/ AddendIsRight: true);
6487 E = ASE->getBase();
6488 goto tryAgain;
6489 }
6490 }
6491
6492 return SLCT_NotALiteral;
6493 }
6494
6495 default:
6496 return SLCT_NotALiteral;
6497 }
6498}
6499
6500// If this expression can be evaluated at compile-time,
6501// check if the result is a StringLiteral and return it
6502// otherwise return nullptr
6503static const Expr *maybeConstEvalStringLiteral(ASTContext &Context,
6504 const Expr *E) {
6505 Expr::EvalResult Result;
6506 if (E->EvaluateAsRValue(Result, Ctx: Context) && Result.Val.isLValue()) {
6507 const auto *LVE = Result.Val.getLValueBase().dyn_cast<const Expr *>();
6508 if (isa_and_nonnull<StringLiteral>(Val: LVE))
6509 return LVE;
6510 }
6511 return nullptr;
6512}
6513
6514StringRef Sema::GetFormatStringTypeName(FormatStringType FST) {
6515 switch (FST) {
6516 case FormatStringType::Scanf:
6517 return "scanf";
6518 case FormatStringType::Printf:
6519 return "printf";
6520 case FormatStringType::NSString:
6521 return "NSString";
6522 case FormatStringType::Strftime:
6523 return "strftime";
6524 case FormatStringType::Strfmon:
6525 return "strfmon";
6526 case FormatStringType::Kprintf:
6527 return "kprintf";
6528 case FormatStringType::FreeBSDKPrintf:
6529 return "freebsd_kprintf";
6530 case FormatStringType::OSLog:
6531 return "os_log";
6532 default:
6533 return "<unknown>";
6534 }
6535}
6536
6537FormatStringType Sema::GetFormatStringType(StringRef Flavor) {
6538 return llvm::StringSwitch<FormatStringType>(Flavor)
6539 .Case(S: "scanf", Value: FormatStringType::Scanf)
6540 .Cases(S0: "printf", S1: "printf0", S2: "syslog", Value: FormatStringType::Printf)
6541 .Cases(S0: "NSString", S1: "CFString", Value: FormatStringType::NSString)
6542 .Case(S: "strftime", Value: FormatStringType::Strftime)
6543 .Case(S: "strfmon", Value: FormatStringType::Strfmon)
6544 .Cases(S0: "kprintf", S1: "cmn_err", S2: "vcmn_err", S3: "zcmn_err",
6545 Value: FormatStringType::Kprintf)
6546 .Case(S: "freebsd_kprintf", Value: FormatStringType::FreeBSDKPrintf)
6547 .Case(S: "os_trace", Value: FormatStringType::OSLog)
6548 .Case(S: "os_log", Value: FormatStringType::OSLog)
6549 .Default(Value: FormatStringType::Unknown);
6550}
6551
6552FormatStringType Sema::GetFormatStringType(const FormatAttr *Format) {
6553 return GetFormatStringType(Flavor: Format->getType()->getName());
6554}
6555
6556FormatStringType Sema::GetFormatStringType(const FormatMatchesAttr *Format) {
6557 return GetFormatStringType(Flavor: Format->getType()->getName());
6558}
6559
6560bool Sema::CheckFormatArguments(const FormatAttr *Format,
6561 ArrayRef<const Expr *> Args, bool IsCXXMember,
6562 VariadicCallType CallType, SourceLocation Loc,
6563 SourceRange Range,
6564 llvm::SmallBitVector &CheckedVarArgs) {
6565 FormatStringInfo FSI;
6566 if (getFormatStringInfo(Format->getFormatIdx(), Format->getFirstArg(),
6567 IsCXXMember,
6568 CallType != VariadicCallType::DoesNotApply, &FSI))
6569 return CheckFormatArguments(
6570 Args, FAPK: FSI.ArgPassingKind, ReferenceFormatString: nullptr, format_idx: FSI.FormatIdx, firstDataArg: FSI.FirstDataArg,
6571 Type: GetFormatStringType(Flavor: Format), CallType, Loc, range: Range, CheckedVarArgs);
6572 return false;
6573}
6574
6575bool Sema::CheckFormatString(const FormatMatchesAttr *Format,
6576 ArrayRef<const Expr *> Args, bool IsCXXMember,
6577 VariadicCallType CallType, SourceLocation Loc,
6578 SourceRange Range,
6579 llvm::SmallBitVector &CheckedVarArgs) {
6580 FormatStringInfo FSI;
6581 if (getFormatStringInfo(Format->getFormatIdx(), 0, IsCXXMember, false,
6582 &FSI)) {
6583 FSI.ArgPassingKind = Sema::FAPK_Elsewhere;
6584 return CheckFormatArguments(Args, FAPK: FSI.ArgPassingKind,
6585 ReferenceFormatString: Format->getFormatString(), format_idx: FSI.FormatIdx,
6586 firstDataArg: FSI.FirstDataArg, Type: GetFormatStringType(Flavor: Format),
6587 CallType, Loc, range: Range, CheckedVarArgs);
6588 }
6589 return false;
6590}
6591
6592bool Sema::CheckFormatArguments(ArrayRef<const Expr *> Args,
6593 Sema::FormatArgumentPassingKind APK,
6594 const StringLiteral *ReferenceFormatString,
6595 unsigned format_idx, unsigned firstDataArg,
6596 FormatStringType Type,
6597 VariadicCallType CallType, SourceLocation Loc,
6598 SourceRange Range,
6599 llvm::SmallBitVector &CheckedVarArgs) {
6600 // CHECK: printf/scanf-like function is called with no format string.
6601 if (format_idx >= Args.size()) {
6602 Diag(Loc, diag::warn_missing_format_string) << Range;
6603 return false;
6604 }
6605
6606 const Expr *OrigFormatExpr = Args[format_idx]->IgnoreParenCasts();
6607
6608 // CHECK: format string is not a string literal.
6609 //
6610 // Dynamically generated format strings are difficult to
6611 // automatically vet at compile time. Requiring that format strings
6612 // are string literals: (1) permits the checking of format strings by
6613 // the compiler and thereby (2) can practically remove the source of
6614 // many format string exploits.
6615
6616 // Format string can be either ObjC string (e.g. @"%d") or
6617 // C string (e.g. "%d")
6618 // ObjC string uses the same format specifiers as C string, so we can use
6619 // the same format string checking logic for both ObjC and C strings.
6620 UncoveredArgHandler UncoveredArg;
6621 StringLiteralCheckType CT = checkFormatStringExpr(
6622 S&: *this, ReferenceFormatString, E: OrigFormatExpr, Args, APK, format_idx,
6623 firstDataArg, Type, CallType,
6624 /*IsFunctionCall*/ InFunctionCall: true, CheckedVarArgs, UncoveredArg,
6625 /*no string offset*/ Offset: llvm::APSInt(64, false) = 0);
6626
6627 // Generate a diagnostic where an uncovered argument is detected.
6628 if (UncoveredArg.hasUncoveredArg()) {
6629 unsigned ArgIdx = UncoveredArg.getUncoveredArg() + firstDataArg;
6630 assert(ArgIdx < Args.size() && "ArgIdx outside bounds");
6631 UncoveredArg.Diagnose(S&: *this, /*IsFunctionCall*/true, ArgExpr: Args[ArgIdx]);
6632 }
6633
6634 if (CT != SLCT_NotALiteral)
6635 // Literal format string found, check done!
6636 return CT == SLCT_CheckedLiteral;
6637
6638 // Strftime is particular as it always uses a single 'time' argument,
6639 // so it is safe to pass a non-literal string.
6640 if (Type == FormatStringType::Strftime)
6641 return false;
6642
6643 // Do not emit diag when the string param is a macro expansion and the
6644 // format is either NSString or CFString. This is a hack to prevent
6645 // diag when using the NSLocalizedString and CFCopyLocalizedString macros
6646 // which are usually used in place of NS and CF string literals.
6647 SourceLocation FormatLoc = Args[format_idx]->getBeginLoc();
6648 if (Type == FormatStringType::NSString &&
6649 SourceMgr.isInSystemMacro(loc: FormatLoc))
6650 return false;
6651
6652 // If there are no arguments specified, warn with -Wformat-security, otherwise
6653 // warn only with -Wformat-nonliteral.
6654 if (Args.size() == firstDataArg) {
6655 Diag(FormatLoc, diag::warn_format_nonliteral_noargs)
6656 << OrigFormatExpr->getSourceRange();
6657 switch (Type) {
6658 default:
6659 break;
6660 case FormatStringType::Kprintf:
6661 case FormatStringType::FreeBSDKPrintf:
6662 case FormatStringType::Printf:
6663 case FormatStringType::Syslog:
6664 Diag(FormatLoc, diag::note_format_security_fixit)
6665 << FixItHint::CreateInsertion(FormatLoc, "\"%s\", ");
6666 break;
6667 case FormatStringType::NSString:
6668 Diag(FormatLoc, diag::note_format_security_fixit)
6669 << FixItHint::CreateInsertion(FormatLoc, "@\"%@\", ");
6670 break;
6671 }
6672 } else {
6673 Diag(FormatLoc, diag::warn_format_nonliteral)
6674 << OrigFormatExpr->getSourceRange();
6675 }
6676 return false;
6677}
6678
6679namespace {
6680
6681class CheckFormatHandler : public analyze_format_string::FormatStringHandler {
6682protected:
6683 Sema &S;
6684 const FormatStringLiteral *FExpr;
6685 const Expr *OrigFormatExpr;
6686 const FormatStringType FSType;
6687 const unsigned FirstDataArg;
6688 const unsigned NumDataArgs;
6689 const char *Beg; // Start of format string.
6690 const Sema::FormatArgumentPassingKind ArgPassingKind;
6691 ArrayRef<const Expr *> Args;
6692 unsigned FormatIdx;
6693 llvm::SmallBitVector CoveredArgs;
6694 bool usesPositionalArgs = false;
6695 bool atFirstArg = true;
6696 bool inFunctionCall;
6697 VariadicCallType CallType;
6698 llvm::SmallBitVector &CheckedVarArgs;
6699 UncoveredArgHandler &UncoveredArg;
6700
6701public:
6702 CheckFormatHandler(Sema &s, const FormatStringLiteral *fexpr,
6703 const Expr *origFormatExpr, const FormatStringType type,
6704 unsigned firstDataArg, unsigned numDataArgs,
6705 const char *beg, Sema::FormatArgumentPassingKind APK,
6706 ArrayRef<const Expr *> Args, unsigned formatIdx,
6707 bool inFunctionCall, VariadicCallType callType,
6708 llvm::SmallBitVector &CheckedVarArgs,
6709 UncoveredArgHandler &UncoveredArg)
6710 : S(s), FExpr(fexpr), OrigFormatExpr(origFormatExpr), FSType(type),
6711 FirstDataArg(firstDataArg), NumDataArgs(numDataArgs), Beg(beg),
6712 ArgPassingKind(APK), Args(Args), FormatIdx(formatIdx),
6713 inFunctionCall(inFunctionCall), CallType(callType),
6714 CheckedVarArgs(CheckedVarArgs), UncoveredArg(UncoveredArg) {
6715 CoveredArgs.resize(N: numDataArgs);
6716 CoveredArgs.reset();
6717 }
6718
6719 bool HasFormatArguments() const {
6720 return ArgPassingKind == Sema::FAPK_Fixed ||
6721 ArgPassingKind == Sema::FAPK_Variadic;
6722 }
6723
6724 void DoneProcessing();
6725
6726 void HandleIncompleteSpecifier(const char *startSpecifier,
6727 unsigned specifierLen) override;
6728
6729 void HandleInvalidLengthModifier(
6730 const analyze_format_string::FormatSpecifier &FS,
6731 const analyze_format_string::ConversionSpecifier &CS,
6732 const char *startSpecifier, unsigned specifierLen,
6733 unsigned DiagID);
6734
6735 void HandleNonStandardLengthModifier(
6736 const analyze_format_string::FormatSpecifier &FS,
6737 const char *startSpecifier, unsigned specifierLen);
6738
6739 void HandleNonStandardConversionSpecifier(
6740 const analyze_format_string::ConversionSpecifier &CS,
6741 const char *startSpecifier, unsigned specifierLen);
6742
6743 void HandlePosition(const char *startPos, unsigned posLen) override;
6744
6745 void HandleInvalidPosition(const char *startSpecifier,
6746 unsigned specifierLen,
6747 analyze_format_string::PositionContext p) override;
6748
6749 void HandleZeroPosition(const char *startPos, unsigned posLen) override;
6750
6751 void HandleNullChar(const char *nullCharacter) override;
6752
6753 template <typename Range>
6754 static void
6755 EmitFormatDiagnostic(Sema &S, bool inFunctionCall, const Expr *ArgumentExpr,
6756 const PartialDiagnostic &PDiag, SourceLocation StringLoc,
6757 bool IsStringLocation, Range StringRange,
6758 ArrayRef<FixItHint> Fixit = {});
6759
6760protected:
6761 bool HandleInvalidConversionSpecifier(unsigned argIndex, SourceLocation Loc,
6762 const char *startSpec,
6763 unsigned specifierLen,
6764 const char *csStart, unsigned csLen);
6765
6766 void HandlePositionalNonpositionalArgs(SourceLocation Loc,
6767 const char *startSpec,
6768 unsigned specifierLen);
6769
6770 SourceRange getFormatStringRange();
6771 CharSourceRange getSpecifierRange(const char *startSpecifier,
6772 unsigned specifierLen);
6773 SourceLocation getLocationOfByte(const char *x);
6774
6775 const Expr *getDataArg(unsigned i) const;
6776
6777 bool CheckNumArgs(const analyze_format_string::FormatSpecifier &FS,
6778 const analyze_format_string::ConversionSpecifier &CS,
6779 const char *startSpecifier, unsigned specifierLen,
6780 unsigned argIndex);
6781
6782 template <typename Range>
6783 void EmitFormatDiagnostic(PartialDiagnostic PDiag, SourceLocation StringLoc,
6784 bool IsStringLocation, Range StringRange,
6785 ArrayRef<FixItHint> Fixit = {});
6786};
6787
6788} // namespace
6789
6790SourceRange CheckFormatHandler::getFormatStringRange() {
6791 return OrigFormatExpr->getSourceRange();
6792}
6793
6794CharSourceRange CheckFormatHandler::
6795getSpecifierRange(const char *startSpecifier, unsigned specifierLen) {
6796 SourceLocation Start = getLocationOfByte(x: startSpecifier);
6797 SourceLocation End = getLocationOfByte(x: startSpecifier + specifierLen - 1);
6798
6799 // Advance the end SourceLocation by one due to half-open ranges.
6800 End = End.getLocWithOffset(Offset: 1);
6801
6802 return CharSourceRange::getCharRange(B: Start, E: End);
6803}
6804
6805SourceLocation CheckFormatHandler::getLocationOfByte(const char *x) {
6806 return FExpr->getLocationOfByte(ByteNo: x - Beg, SM: S.getSourceManager(),
6807 Features: S.getLangOpts(), Target: S.Context.getTargetInfo());
6808}
6809
6810void CheckFormatHandler::HandleIncompleteSpecifier(const char *startSpecifier,
6811 unsigned specifierLen){
6812 EmitFormatDiagnostic(S.PDiag(diag::warn_printf_incomplete_specifier),
6813 getLocationOfByte(startSpecifier),
6814 /*IsStringLocation*/true,
6815 getSpecifierRange(startSpecifier, specifierLen));
6816}
6817
6818void CheckFormatHandler::HandleInvalidLengthModifier(
6819 const analyze_format_string::FormatSpecifier &FS,
6820 const analyze_format_string::ConversionSpecifier &CS,
6821 const char *startSpecifier, unsigned specifierLen, unsigned DiagID) {
6822 using namespace analyze_format_string;
6823
6824 const LengthModifier &LM = FS.getLengthModifier();
6825 CharSourceRange LMRange = getSpecifierRange(startSpecifier: LM.getStart(), specifierLen: LM.getLength());
6826
6827 // See if we know how to fix this length modifier.
6828 std::optional<LengthModifier> FixedLM = FS.getCorrectedLengthModifier();
6829 if (FixedLM) {
6830 EmitFormatDiagnostic(S.PDiag(DiagID) << LM.toString() << CS.toString(),
6831 getLocationOfByte(x: LM.getStart()),
6832 /*IsStringLocation*/true,
6833 getSpecifierRange(startSpecifier, specifierLen));
6834
6835 S.Diag(getLocationOfByte(LM.getStart()), diag::note_format_fix_specifier)
6836 << FixedLM->toString()
6837 << FixItHint::CreateReplacement(LMRange, FixedLM->toString());
6838
6839 } else {
6840 FixItHint Hint;
6841 if (DiagID == diag::warn_format_nonsensical_length)
6842 Hint = FixItHint::CreateRemoval(RemoveRange: LMRange);
6843
6844 EmitFormatDiagnostic(S.PDiag(DiagID) << LM.toString() << CS.toString(),
6845 getLocationOfByte(x: LM.getStart()),
6846 /*IsStringLocation*/true,
6847 getSpecifierRange(startSpecifier, specifierLen),
6848 Hint);
6849 }
6850}
6851
6852void CheckFormatHandler::HandleNonStandardLengthModifier(
6853 const analyze_format_string::FormatSpecifier &FS,
6854 const char *startSpecifier, unsigned specifierLen) {
6855 using namespace analyze_format_string;
6856
6857 const LengthModifier &LM = FS.getLengthModifier();
6858 CharSourceRange LMRange = getSpecifierRange(startSpecifier: LM.getStart(), specifierLen: LM.getLength());
6859
6860 // See if we know how to fix this length modifier.
6861 std::optional<LengthModifier> FixedLM = FS.getCorrectedLengthModifier();
6862 if (FixedLM) {
6863 EmitFormatDiagnostic(S.PDiag(diag::warn_format_non_standard)
6864 << LM.toString() << 0,
6865 getLocationOfByte(LM.getStart()),
6866 /*IsStringLocation*/true,
6867 getSpecifierRange(startSpecifier, specifierLen));
6868
6869 S.Diag(getLocationOfByte(LM.getStart()), diag::note_format_fix_specifier)
6870 << FixedLM->toString()
6871 << FixItHint::CreateReplacement(LMRange, FixedLM->toString());
6872
6873 } else {
6874 EmitFormatDiagnostic(S.PDiag(diag::warn_format_non_standard)
6875 << LM.toString() << 0,
6876 getLocationOfByte(LM.getStart()),
6877 /*IsStringLocation*/true,
6878 getSpecifierRange(startSpecifier, specifierLen));
6879 }
6880}
6881
6882void CheckFormatHandler::HandleNonStandardConversionSpecifier(
6883 const analyze_format_string::ConversionSpecifier &CS,
6884 const char *startSpecifier, unsigned specifierLen) {
6885 using namespace analyze_format_string;
6886
6887 // See if we know how to fix this conversion specifier.
6888 std::optional<ConversionSpecifier> FixedCS = CS.getStandardSpecifier();
6889 if (FixedCS) {
6890 EmitFormatDiagnostic(S.PDiag(diag::warn_format_non_standard)
6891 << CS.toString() << /*conversion specifier*/1,
6892 getLocationOfByte(CS.getStart()),
6893 /*IsStringLocation*/true,
6894 getSpecifierRange(startSpecifier, specifierLen));
6895
6896 CharSourceRange CSRange = getSpecifierRange(startSpecifier: CS.getStart(), specifierLen: CS.getLength());
6897 S.Diag(getLocationOfByte(CS.getStart()), diag::note_format_fix_specifier)
6898 << FixedCS->toString()
6899 << FixItHint::CreateReplacement(CSRange, FixedCS->toString());
6900 } else {
6901 EmitFormatDiagnostic(S.PDiag(diag::warn_format_non_standard)
6902 << CS.toString() << /*conversion specifier*/1,
6903 getLocationOfByte(CS.getStart()),
6904 /*IsStringLocation*/true,
6905 getSpecifierRange(startSpecifier, specifierLen));
6906 }
6907}
6908
6909void CheckFormatHandler::HandlePosition(const char *startPos,
6910 unsigned posLen) {
6911 if (!S.getDiagnostics().isIgnored(
6912 diag::warn_format_non_standard_positional_arg, SourceLocation()))
6913 EmitFormatDiagnostic(S.PDiag(diag::warn_format_non_standard_positional_arg),
6914 getLocationOfByte(startPos),
6915 /*IsStringLocation*/ true,
6916 getSpecifierRange(startPos, posLen));
6917}
6918
6919void CheckFormatHandler::HandleInvalidPosition(
6920 const char *startSpecifier, unsigned specifierLen,
6921 analyze_format_string::PositionContext p) {
6922 if (!S.getDiagnostics().isIgnored(
6923 diag::warn_format_invalid_positional_specifier, SourceLocation()))
6924 EmitFormatDiagnostic(
6925 S.PDiag(diag::warn_format_invalid_positional_specifier) << (unsigned)p,
6926 getLocationOfByte(startSpecifier), /*IsStringLocation*/ true,
6927 getSpecifierRange(startSpecifier, specifierLen));
6928}
6929
6930void CheckFormatHandler::HandleZeroPosition(const char *startPos,
6931 unsigned posLen) {
6932 if (!S.getDiagnostics().isIgnored(diag::warn_format_zero_positional_specifier,
6933 SourceLocation()))
6934 EmitFormatDiagnostic(S.PDiag(diag::warn_format_zero_positional_specifier),
6935 getLocationOfByte(startPos),
6936 /*IsStringLocation*/ true,
6937 getSpecifierRange(startPos, posLen));
6938}
6939
6940void CheckFormatHandler::HandleNullChar(const char *nullCharacter) {
6941 if (!isa<ObjCStringLiteral>(Val: OrigFormatExpr)) {
6942 // The presence of a null character is likely an error.
6943 EmitFormatDiagnostic(
6944 S.PDiag(diag::warn_printf_format_string_contains_null_char),
6945 getLocationOfByte(nullCharacter), /*IsStringLocation*/true,
6946 getFormatStringRange());
6947 }
6948}
6949
6950// Note that this may return NULL if there was an error parsing or building
6951// one of the argument expressions.
6952const Expr *CheckFormatHandler::getDataArg(unsigned i) const {
6953 return Args[FirstDataArg + i];
6954}
6955
6956void CheckFormatHandler::DoneProcessing() {
6957 // Does the number of data arguments exceed the number of
6958 // format conversions in the format string?
6959 if (HasFormatArguments()) {
6960 // Find any arguments that weren't covered.
6961 CoveredArgs.flip();
6962 signed notCoveredArg = CoveredArgs.find_first();
6963 if (notCoveredArg >= 0) {
6964 assert((unsigned)notCoveredArg < NumDataArgs);
6965 UncoveredArg.Update(NewFirstUncoveredArg: notCoveredArg, StrExpr: OrigFormatExpr);
6966 } else {
6967 UncoveredArg.setAllCovered();
6968 }
6969 }
6970}
6971
6972void UncoveredArgHandler::Diagnose(Sema &S, bool IsFunctionCall,
6973 const Expr *ArgExpr) {
6974 assert(hasUncoveredArg() && !DiagnosticExprs.empty() &&
6975 "Invalid state");
6976
6977 if (!ArgExpr)
6978 return;
6979
6980 SourceLocation Loc = ArgExpr->getBeginLoc();
6981
6982 if (S.getSourceManager().isInSystemMacro(loc: Loc))
6983 return;
6984
6985 PartialDiagnostic PDiag = S.PDiag(diag::warn_printf_data_arg_not_used);
6986 for (auto E : DiagnosticExprs)
6987 PDiag << E->getSourceRange();
6988
6989 CheckFormatHandler::EmitFormatDiagnostic(
6990 S, IsFunctionCall, DiagnosticExprs[0],
6991 PDiag, Loc, /*IsStringLocation*/false,
6992 DiagnosticExprs[0]->getSourceRange());
6993}
6994
6995bool
6996CheckFormatHandler::HandleInvalidConversionSpecifier(unsigned argIndex,
6997 SourceLocation Loc,
6998 const char *startSpec,
6999 unsigned specifierLen,
7000 const char *csStart,
7001 unsigned csLen) {
7002 bool keepGoing = true;
7003 if (argIndex < NumDataArgs) {
7004 // Consider the argument coverered, even though the specifier doesn't
7005 // make sense.
7006 CoveredArgs.set(argIndex);
7007 }
7008 else {
7009 // If argIndex exceeds the number of data arguments we
7010 // don't issue a warning because that is just a cascade of warnings (and
7011 // they may have intended '%%' anyway). We don't want to continue processing
7012 // the format string after this point, however, as we will like just get
7013 // gibberish when trying to match arguments.
7014 keepGoing = false;
7015 }
7016
7017 StringRef Specifier(csStart, csLen);
7018
7019 // If the specifier in non-printable, it could be the first byte of a UTF-8
7020 // sequence. In that case, print the UTF-8 code point. If not, print the byte
7021 // hex value.
7022 std::string CodePointStr;
7023 if (!llvm::sys::locale::isPrint(c: *csStart)) {
7024 llvm::UTF32 CodePoint;
7025 const llvm::UTF8 **B = reinterpret_cast<const llvm::UTF8 **>(&csStart);
7026 const llvm::UTF8 *E =
7027 reinterpret_cast<const llvm::UTF8 *>(csStart + csLen);
7028 llvm::ConversionResult Result =
7029 llvm::convertUTF8Sequence(source: B, sourceEnd: E, target: &CodePoint, flags: llvm::strictConversion);
7030
7031 if (Result != llvm::conversionOK) {
7032 unsigned char FirstChar = *csStart;
7033 CodePoint = (llvm::UTF32)FirstChar;
7034 }
7035
7036 llvm::raw_string_ostream OS(CodePointStr);
7037 if (CodePoint < 256)
7038 OS << "\\x" << llvm::format(Fmt: "%02x", Vals: CodePoint);
7039 else if (CodePoint <= 0xFFFF)
7040 OS << "\\u" << llvm::format(Fmt: "%04x", Vals: CodePoint);
7041 else
7042 OS << "\\U" << llvm::format(Fmt: "%08x", Vals: CodePoint);
7043 Specifier = CodePointStr;
7044 }
7045
7046 EmitFormatDiagnostic(
7047 S.PDiag(diag::warn_format_invalid_conversion) << Specifier, Loc,
7048 /*IsStringLocation*/ true, getSpecifierRange(startSpec, specifierLen));
7049
7050 return keepGoing;
7051}
7052
7053void
7054CheckFormatHandler::HandlePositionalNonpositionalArgs(SourceLocation Loc,
7055 const char *startSpec,
7056 unsigned specifierLen) {
7057 EmitFormatDiagnostic(
7058 S.PDiag(diag::warn_format_mix_positional_nonpositional_args),
7059 Loc, /*isStringLoc*/true, getSpecifierRange(startSpec, specifierLen));
7060}
7061
7062bool
7063CheckFormatHandler::CheckNumArgs(
7064 const analyze_format_string::FormatSpecifier &FS,
7065 const analyze_format_string::ConversionSpecifier &CS,
7066 const char *startSpecifier, unsigned specifierLen, unsigned argIndex) {
7067
7068 if (HasFormatArguments() && argIndex >= NumDataArgs) {
7069 PartialDiagnostic PDiag = FS.usesPositionalArg()
7070 ? (S.PDiag(diag::warn_printf_positional_arg_exceeds_data_args)
7071 << (argIndex+1) << NumDataArgs)
7072 : S.PDiag(diag::warn_printf_insufficient_data_args);
7073 EmitFormatDiagnostic(
7074 PDiag, Loc: getLocationOfByte(x: CS.getStart()), /*IsStringLocation*/true,
7075 StringRange: getSpecifierRange(startSpecifier, specifierLen));
7076
7077 // Since more arguments than conversion tokens are given, by extension
7078 // all arguments are covered, so mark this as so.
7079 UncoveredArg.setAllCovered();
7080 return false;
7081 }
7082 return true;
7083}
7084
7085template<typename Range>
7086void CheckFormatHandler::EmitFormatDiagnostic(PartialDiagnostic PDiag,
7087 SourceLocation Loc,
7088 bool IsStringLocation,
7089 Range StringRange,
7090 ArrayRef<FixItHint> FixIt) {
7091 EmitFormatDiagnostic(S, inFunctionCall, Args[FormatIdx], PDiag,
7092 Loc, IsStringLocation, StringRange, FixIt);
7093}
7094
7095/// If the format string is not within the function call, emit a note
7096/// so that the function call and string are in diagnostic messages.
7097///
7098/// \param InFunctionCall if true, the format string is within the function
7099/// call and only one diagnostic message will be produced. Otherwise, an
7100/// extra note will be emitted pointing to location of the format string.
7101///
7102/// \param ArgumentExpr the expression that is passed as the format string
7103/// argument in the function call. Used for getting locations when two
7104/// diagnostics are emitted.
7105///
7106/// \param PDiag the callee should already have provided any strings for the
7107/// diagnostic message. This function only adds locations and fixits
7108/// to diagnostics.
7109///
7110/// \param Loc primary location for diagnostic. If two diagnostics are
7111/// required, one will be at Loc and a new SourceLocation will be created for
7112/// the other one.
7113///
7114/// \param IsStringLocation if true, Loc points to the format string should be
7115/// used for the note. Otherwise, Loc points to the argument list and will
7116/// be used with PDiag.
7117///
7118/// \param StringRange some or all of the string to highlight. This is
7119/// templated so it can accept either a CharSourceRange or a SourceRange.
7120///
7121/// \param FixIt optional fix it hint for the format string.
7122template <typename Range>
7123void CheckFormatHandler::EmitFormatDiagnostic(
7124 Sema &S, bool InFunctionCall, const Expr *ArgumentExpr,
7125 const PartialDiagnostic &PDiag, SourceLocation Loc, bool IsStringLocation,
7126 Range StringRange, ArrayRef<FixItHint> FixIt) {
7127 if (InFunctionCall) {
7128 const Sema::SemaDiagnosticBuilder &D = S.Diag(Loc, PDiag);
7129 D << StringRange;
7130 D << FixIt;
7131 } else {
7132 S.Diag(IsStringLocation ? ArgumentExpr->getExprLoc() : Loc, PDiag)
7133 << ArgumentExpr->getSourceRange();
7134
7135 const Sema::SemaDiagnosticBuilder &Note =
7136 S.Diag(IsStringLocation ? Loc : StringRange.getBegin(),
7137 diag::note_format_string_defined);
7138
7139 Note << StringRange;
7140 Note << FixIt;
7141 }
7142}
7143
7144//===--- CHECK: Printf format string checking -----------------------------===//
7145
7146namespace {
7147
7148class CheckPrintfHandler : public CheckFormatHandler {
7149public:
7150 CheckPrintfHandler(Sema &s, const FormatStringLiteral *fexpr,
7151 const Expr *origFormatExpr, const FormatStringType type,
7152 unsigned firstDataArg, unsigned numDataArgs, bool isObjC,
7153 const char *beg, Sema::FormatArgumentPassingKind APK,
7154 ArrayRef<const Expr *> Args, unsigned formatIdx,
7155 bool inFunctionCall, VariadicCallType CallType,
7156 llvm::SmallBitVector &CheckedVarArgs,
7157 UncoveredArgHandler &UncoveredArg)
7158 : CheckFormatHandler(s, fexpr, origFormatExpr, type, firstDataArg,
7159 numDataArgs, beg, APK, Args, formatIdx,
7160 inFunctionCall, CallType, CheckedVarArgs,
7161 UncoveredArg) {}
7162
7163 bool isObjCContext() const { return FSType == FormatStringType::NSString; }
7164
7165 /// Returns true if '%@' specifiers are allowed in the format string.
7166 bool allowsObjCArg() const {
7167 return FSType == FormatStringType::NSString ||
7168 FSType == FormatStringType::OSLog ||
7169 FSType == FormatStringType::OSTrace;
7170 }
7171
7172 bool HandleInvalidPrintfConversionSpecifier(
7173 const analyze_printf::PrintfSpecifier &FS,
7174 const char *startSpecifier,
7175 unsigned specifierLen) override;
7176
7177 void handleInvalidMaskType(StringRef MaskType) override;
7178
7179 bool HandlePrintfSpecifier(const analyze_printf::PrintfSpecifier &FS,
7180 const char *startSpecifier, unsigned specifierLen,
7181 const TargetInfo &Target) override;
7182 bool checkFormatExpr(const analyze_printf::PrintfSpecifier &FS,
7183 const char *StartSpecifier,
7184 unsigned SpecifierLen,
7185 const Expr *E);
7186
7187 bool HandleAmount(const analyze_format_string::OptionalAmount &Amt, unsigned k,
7188 const char *startSpecifier, unsigned specifierLen);
7189 void HandleInvalidAmount(const analyze_printf::PrintfSpecifier &FS,
7190 const analyze_printf::OptionalAmount &Amt,
7191 unsigned type,
7192 const char *startSpecifier, unsigned specifierLen);
7193 void HandleFlag(const analyze_printf::PrintfSpecifier &FS,
7194 const analyze_printf::OptionalFlag &flag,
7195 const char *startSpecifier, unsigned specifierLen);
7196 void HandleIgnoredFlag(const analyze_printf::PrintfSpecifier &FS,
7197 const analyze_printf::OptionalFlag &ignoredFlag,
7198 const analyze_printf::OptionalFlag &flag,
7199 const char *startSpecifier, unsigned specifierLen);
7200 bool checkForCStrMembers(const analyze_printf::ArgType &AT,
7201 const Expr *E);
7202
7203 void HandleEmptyObjCModifierFlag(const char *startFlag,
7204 unsigned flagLen) override;
7205
7206 void HandleInvalidObjCModifierFlag(const char *startFlag,
7207 unsigned flagLen) override;
7208
7209 void
7210 HandleObjCFlagsWithNonObjCConversion(const char *flagsStart,
7211 const char *flagsEnd,
7212 const char *conversionPosition) override;
7213};
7214
7215/// Keeps around the information needed to verify that two specifiers are
7216/// compatible.
7217class EquatableFormatArgument {
7218public:
7219 enum SpecifierSensitivity : unsigned {
7220 SS_None,
7221 SS_Private,
7222 SS_Public,
7223 SS_Sensitive
7224 };
7225
7226 enum FormatArgumentRole : unsigned {
7227 FAR_Data,
7228 FAR_FieldWidth,
7229 FAR_Precision,
7230 FAR_Auxiliary, // FreeBSD kernel %b and %D
7231 };
7232
7233private:
7234 analyze_format_string::ArgType ArgType;
7235 analyze_format_string::LengthModifier::Kind LengthMod;
7236 StringRef SpecifierLetter;
7237 CharSourceRange Range;
7238 SourceLocation ElementLoc;
7239 FormatArgumentRole Role : 2;
7240 SpecifierSensitivity Sensitivity : 2; // only set for FAR_Data
7241 unsigned Position : 14;
7242 unsigned ModifierFor : 14; // not set for FAR_Data
7243
7244 void EmitDiagnostic(Sema &S, PartialDiagnostic PDiag, const Expr *FmtExpr,
7245 bool InFunctionCall) const;
7246
7247public:
7248 EquatableFormatArgument(CharSourceRange Range, SourceLocation ElementLoc,
7249 analyze_format_string::LengthModifier::Kind LengthMod,
7250 StringRef SpecifierLetter,
7251 analyze_format_string::ArgType ArgType,
7252 FormatArgumentRole Role,
7253 SpecifierSensitivity Sensitivity, unsigned Position,
7254 unsigned ModifierFor)
7255 : ArgType(ArgType), LengthMod(LengthMod),
7256 SpecifierLetter(SpecifierLetter), Range(Range), ElementLoc(ElementLoc),
7257 Role(Role), Sensitivity(Sensitivity), Position(Position),
7258 ModifierFor(ModifierFor) {}
7259
7260 unsigned getPosition() const { return Position; }
7261 SourceLocation getSourceLocation() const { return ElementLoc; }
7262 CharSourceRange getSourceRange() const { return Range; }
7263 analyze_format_string::LengthModifier getLengthModifier() const {
7264 return analyze_format_string::LengthModifier(nullptr, LengthMod);
7265 }
7266 void setModifierFor(unsigned V) { ModifierFor = V; }
7267
7268 std::string buildFormatSpecifier() const {
7269 std::string result;
7270 llvm::raw_string_ostream(result)
7271 << getLengthModifier().toString() << SpecifierLetter;
7272 return result;
7273 }
7274
7275 bool VerifyCompatible(Sema &S, const EquatableFormatArgument &Other,
7276 const Expr *FmtExpr, bool InFunctionCall) const;
7277};
7278
7279/// Turns format strings into lists of EquatableSpecifier objects.
7280class DecomposePrintfHandler : public CheckPrintfHandler {
7281 llvm::SmallVectorImpl<EquatableFormatArgument> &Specs;
7282 bool HadError;
7283
7284 DecomposePrintfHandler(Sema &s, const FormatStringLiteral *fexpr,
7285 const Expr *origFormatExpr,
7286 const FormatStringType type, unsigned firstDataArg,
7287 unsigned numDataArgs, bool isObjC, const char *beg,
7288 Sema::FormatArgumentPassingKind APK,
7289 ArrayRef<const Expr *> Args, unsigned formatIdx,
7290 bool inFunctionCall, VariadicCallType CallType,
7291 llvm::SmallBitVector &CheckedVarArgs,
7292 UncoveredArgHandler &UncoveredArg,
7293 llvm::SmallVectorImpl<EquatableFormatArgument> &Specs)
7294 : CheckPrintfHandler(s, fexpr, origFormatExpr, type, firstDataArg,
7295 numDataArgs, isObjC, beg, APK, Args, formatIdx,
7296 inFunctionCall, CallType, CheckedVarArgs,
7297 UncoveredArg),
7298 Specs(Specs), HadError(false) {}
7299
7300public:
7301 static bool
7302 GetSpecifiers(Sema &S, const FormatStringLiteral *FSL, const Expr *FmtExpr,
7303 FormatStringType type, bool IsObjC, bool InFunctionCall,
7304 llvm::SmallVectorImpl<EquatableFormatArgument> &Args);
7305
7306 virtual bool HandlePrintfSpecifier(const analyze_printf::PrintfSpecifier &FS,
7307 const char *startSpecifier,
7308 unsigned specifierLen,
7309 const TargetInfo &Target) override;
7310};
7311
7312} // namespace
7313
7314bool CheckPrintfHandler::HandleInvalidPrintfConversionSpecifier(
7315 const analyze_printf::PrintfSpecifier &FS, const char *startSpecifier,
7316 unsigned specifierLen) {
7317 const analyze_printf::PrintfConversionSpecifier &CS =
7318 FS.getConversionSpecifier();
7319
7320 return HandleInvalidConversionSpecifier(argIndex: FS.getArgIndex(),
7321 Loc: getLocationOfByte(x: CS.getStart()),
7322 startSpec: startSpecifier, specifierLen,
7323 csStart: CS.getStart(), csLen: CS.getLength());
7324}
7325
7326void CheckPrintfHandler::handleInvalidMaskType(StringRef MaskType) {
7327 S.Diag(getLocationOfByte(MaskType.data()), diag::err_invalid_mask_type_size);
7328}
7329
7330bool CheckPrintfHandler::HandleAmount(
7331 const analyze_format_string::OptionalAmount &Amt, unsigned k,
7332 const char *startSpecifier, unsigned specifierLen) {
7333 if (Amt.hasDataArgument()) {
7334 if (HasFormatArguments()) {
7335 unsigned argIndex = Amt.getArgIndex();
7336 if (argIndex >= NumDataArgs) {
7337 EmitFormatDiagnostic(S.PDiag(diag::warn_printf_asterisk_missing_arg)
7338 << k,
7339 getLocationOfByte(Amt.getStart()),
7340 /*IsStringLocation*/ true,
7341 getSpecifierRange(startSpecifier, specifierLen));
7342 // Don't do any more checking. We will just emit
7343 // spurious errors.
7344 return false;
7345 }
7346
7347 // Type check the data argument. It should be an 'int'.
7348 // Although not in conformance with C99, we also allow the argument to be
7349 // an 'unsigned int' as that is a reasonably safe case. GCC also
7350 // doesn't emit a warning for that case.
7351 CoveredArgs.set(argIndex);
7352 const Expr *Arg = getDataArg(i: argIndex);
7353 if (!Arg)
7354 return false;
7355
7356 QualType T = Arg->getType();
7357
7358 const analyze_printf::ArgType &AT = Amt.getArgType(Ctx&: S.Context);
7359 assert(AT.isValid());
7360
7361 if (!AT.matchesType(C&: S.Context, argTy: T)) {
7362 EmitFormatDiagnostic(S.PDiag(diag::warn_printf_asterisk_wrong_type)
7363 << k << AT.getRepresentativeTypeName(S.Context)
7364 << T << Arg->getSourceRange(),
7365 getLocationOfByte(Amt.getStart()),
7366 /*IsStringLocation*/true,
7367 getSpecifierRange(startSpecifier, specifierLen));
7368 // Don't do any more checking. We will just emit
7369 // spurious errors.
7370 return false;
7371 }
7372 }
7373 }
7374 return true;
7375}
7376
7377void CheckPrintfHandler::HandleInvalidAmount(
7378 const analyze_printf::PrintfSpecifier &FS,
7379 const analyze_printf::OptionalAmount &Amt,
7380 unsigned type,
7381 const char *startSpecifier,
7382 unsigned specifierLen) {
7383 const analyze_printf::PrintfConversionSpecifier &CS =
7384 FS.getConversionSpecifier();
7385
7386 FixItHint fixit =
7387 Amt.getHowSpecified() == analyze_printf::OptionalAmount::Constant
7388 ? FixItHint::CreateRemoval(RemoveRange: getSpecifierRange(startSpecifier: Amt.getStart(),
7389 specifierLen: Amt.getConstantLength()))
7390 : FixItHint();
7391
7392 EmitFormatDiagnostic(S.PDiag(diag::warn_printf_nonsensical_optional_amount)
7393 << type << CS.toString(),
7394 getLocationOfByte(Amt.getStart()),
7395 /*IsStringLocation*/true,
7396 getSpecifierRange(startSpecifier, specifierLen),
7397 fixit);
7398}
7399
7400void CheckPrintfHandler::HandleFlag(const analyze_printf::PrintfSpecifier &FS,
7401 const analyze_printf::OptionalFlag &flag,
7402 const char *startSpecifier,
7403 unsigned specifierLen) {
7404 // Warn about pointless flag with a fixit removal.
7405 const analyze_printf::PrintfConversionSpecifier &CS =
7406 FS.getConversionSpecifier();
7407 EmitFormatDiagnostic(S.PDiag(diag::warn_printf_nonsensical_flag)
7408 << flag.toString() << CS.toString(),
7409 getLocationOfByte(flag.getPosition()),
7410 /*IsStringLocation*/true,
7411 getSpecifierRange(startSpecifier, specifierLen),
7412 FixItHint::CreateRemoval(
7413 getSpecifierRange(flag.getPosition(), 1)));
7414}
7415
7416void CheckPrintfHandler::HandleIgnoredFlag(
7417 const analyze_printf::PrintfSpecifier &FS,
7418 const analyze_printf::OptionalFlag &ignoredFlag,
7419 const analyze_printf::OptionalFlag &flag,
7420 const char *startSpecifier,
7421 unsigned specifierLen) {
7422 // Warn about ignored flag with a fixit removal.
7423 EmitFormatDiagnostic(S.PDiag(diag::warn_printf_ignored_flag)
7424 << ignoredFlag.toString() << flag.toString(),
7425 getLocationOfByte(ignoredFlag.getPosition()),
7426 /*IsStringLocation*/true,
7427 getSpecifierRange(startSpecifier, specifierLen),
7428 FixItHint::CreateRemoval(
7429 getSpecifierRange(ignoredFlag.getPosition(), 1)));
7430}
7431
7432void CheckPrintfHandler::HandleEmptyObjCModifierFlag(const char *startFlag,
7433 unsigned flagLen) {
7434 // Warn about an empty flag.
7435 EmitFormatDiagnostic(S.PDiag(diag::warn_printf_empty_objc_flag),
7436 getLocationOfByte(startFlag),
7437 /*IsStringLocation*/true,
7438 getSpecifierRange(startFlag, flagLen));
7439}
7440
7441void CheckPrintfHandler::HandleInvalidObjCModifierFlag(const char *startFlag,
7442 unsigned flagLen) {
7443 // Warn about an invalid flag.
7444 auto Range = getSpecifierRange(startSpecifier: startFlag, specifierLen: flagLen);
7445 StringRef flag(startFlag, flagLen);
7446 EmitFormatDiagnostic(S.PDiag(diag::warn_printf_invalid_objc_flag) << flag,
7447 getLocationOfByte(startFlag),
7448 /*IsStringLocation*/true,
7449 Range, FixItHint::CreateRemoval(Range));
7450}
7451
7452void CheckPrintfHandler::HandleObjCFlagsWithNonObjCConversion(
7453 const char *flagsStart, const char *flagsEnd, const char *conversionPosition) {
7454 // Warn about using '[...]' without a '@' conversion.
7455 auto Range = getSpecifierRange(startSpecifier: flagsStart, specifierLen: flagsEnd - flagsStart + 1);
7456 auto diag = diag::warn_printf_ObjCflags_without_ObjCConversion;
7457 EmitFormatDiagnostic(S.PDiag(DiagID: diag) << StringRef(conversionPosition, 1),
7458 getLocationOfByte(x: conversionPosition),
7459 /*IsStringLocation*/ true, Range,
7460 FixItHint::CreateRemoval(RemoveRange: Range));
7461}
7462
7463void EquatableFormatArgument::EmitDiagnostic(Sema &S, PartialDiagnostic PDiag,
7464 const Expr *FmtExpr,
7465 bool InFunctionCall) const {
7466 CheckFormatHandler::EmitFormatDiagnostic(S, InFunctionCall, ArgumentExpr: FmtExpr, PDiag,
7467 Loc: ElementLoc, IsStringLocation: true, StringRange: Range);
7468}
7469
7470bool EquatableFormatArgument::VerifyCompatible(
7471 Sema &S, const EquatableFormatArgument &Other, const Expr *FmtExpr,
7472 bool InFunctionCall) const {
7473 using MK = analyze_format_string::ArgType::MatchKind;
7474 if (Role != Other.Role) {
7475 // diagnose and stop
7476 EmitDiagnostic(
7477 S, S.PDiag(diag::warn_format_cmp_role_mismatch) << Role << Other.Role,
7478 FmtExpr, InFunctionCall);
7479 S.Diag(Other.ElementLoc, diag::note_format_cmp_with) << 0 << Other.Range;
7480 return false;
7481 }
7482
7483 if (Role != FAR_Data) {
7484 if (ModifierFor != Other.ModifierFor) {
7485 // diagnose and stop
7486 EmitDiagnostic(S,
7487 S.PDiag(diag::warn_format_cmp_modifierfor_mismatch)
7488 << (ModifierFor + 1) << (Other.ModifierFor + 1),
7489 FmtExpr, InFunctionCall);
7490 S.Diag(Other.ElementLoc, diag::note_format_cmp_with) << 0 << Other.Range;
7491 return false;
7492 }
7493 return true;
7494 }
7495
7496 bool HadError = false;
7497 if (Sensitivity != Other.Sensitivity) {
7498 // diagnose and continue
7499 EmitDiagnostic(S,
7500 S.PDiag(diag::warn_format_cmp_sensitivity_mismatch)
7501 << Sensitivity << Other.Sensitivity,
7502 FmtExpr, InFunctionCall);
7503 HadError = S.Diag(Other.ElementLoc, diag::note_format_cmp_with)
7504 << 0 << Other.Range;
7505 }
7506
7507 switch (ArgType.matchesArgType(S.Context, Other.ArgType)) {
7508 case MK::Match:
7509 break;
7510
7511 case MK::MatchPromotion:
7512 // Per consensus reached at https://discourse.llvm.org/t/-/83076/12,
7513 // MatchPromotion is treated as a failure by format_matches.
7514 case MK::NoMatch:
7515 case MK::NoMatchTypeConfusion:
7516 case MK::NoMatchPromotionTypeConfusion:
7517 EmitDiagnostic(S,
7518 S.PDiag(diag::warn_format_cmp_specifier_mismatch)
7519 << buildFormatSpecifier()
7520 << Other.buildFormatSpecifier(),
7521 FmtExpr, InFunctionCall);
7522 HadError = S.Diag(Other.ElementLoc, diag::note_format_cmp_with)
7523 << 0 << Other.Range;
7524 break;
7525
7526 case MK::NoMatchPedantic:
7527 EmitDiagnostic(S,
7528 S.PDiag(diag::warn_format_cmp_specifier_mismatch_pedantic)
7529 << buildFormatSpecifier()
7530 << Other.buildFormatSpecifier(),
7531 FmtExpr, InFunctionCall);
7532 HadError = S.Diag(Other.ElementLoc, diag::note_format_cmp_with)
7533 << 0 << Other.Range;
7534 break;
7535
7536 case MK::NoMatchSignedness:
7537 if (!S.getDiagnostics().isIgnored(
7538 diag::warn_format_conversion_argument_type_mismatch_signedness,
7539 ElementLoc)) {
7540 EmitDiagnostic(S,
7541 S.PDiag(diag::warn_format_cmp_specifier_sign_mismatch)
7542 << buildFormatSpecifier()
7543 << Other.buildFormatSpecifier(),
7544 FmtExpr, InFunctionCall);
7545 HadError = S.Diag(Other.ElementLoc, diag::note_format_cmp_with)
7546 << 0 << Other.Range;
7547 }
7548 break;
7549 }
7550 return !HadError;
7551}
7552
7553bool DecomposePrintfHandler::GetSpecifiers(
7554 Sema &S, const FormatStringLiteral *FSL, const Expr *FmtExpr,
7555 FormatStringType Type, bool IsObjC, bool InFunctionCall,
7556 llvm::SmallVectorImpl<EquatableFormatArgument> &Args) {
7557 StringRef Data = FSL->getString();
7558 const char *Str = Data.data();
7559 llvm::SmallBitVector BV;
7560 UncoveredArgHandler UA;
7561 const Expr *PrintfArgs[] = {FSL->getFormatString()};
7562 DecomposePrintfHandler H(S, FSL, FSL->getFormatString(), Type, 0, 0, IsObjC,
7563 Str, Sema::FAPK_Elsewhere, PrintfArgs, 0,
7564 InFunctionCall, VariadicCallType::DoesNotApply, BV,
7565 UA, Args);
7566
7567 if (!analyze_format_string::ParsePrintfString(
7568 H, beg: Str, end: Str + Data.size(), LO: S.getLangOpts(), Target: S.Context.getTargetInfo(),
7569 isFreeBSDKPrintf: Type == FormatStringType::FreeBSDKPrintf))
7570 H.DoneProcessing();
7571 if (H.HadError)
7572 return false;
7573
7574 llvm::stable_sort(Range&: Args, C: [](const EquatableFormatArgument &A,
7575 const EquatableFormatArgument &B) {
7576 return A.getPosition() < B.getPosition();
7577 });
7578 return true;
7579}
7580
7581bool DecomposePrintfHandler::HandlePrintfSpecifier(
7582 const analyze_printf::PrintfSpecifier &FS, const char *startSpecifier,
7583 unsigned specifierLen, const TargetInfo &Target) {
7584 if (!CheckPrintfHandler::HandlePrintfSpecifier(FS, startSpecifier,
7585 specifierLen, Target)) {
7586 HadError = true;
7587 return false;
7588 }
7589
7590 // Do not add any specifiers to the list for %%. This is possibly incorrect
7591 // if using a precision/width with a data argument, but that combination is
7592 // meaningless and we wouldn't know which format to attach the
7593 // precision/width to.
7594 const auto &CS = FS.getConversionSpecifier();
7595 if (CS.getKind() == analyze_format_string::ConversionSpecifier::PercentArg)
7596 return true;
7597
7598 // have to patch these to have the right ModifierFor if they are used
7599 const unsigned Unset = ~0;
7600 unsigned FieldWidthIndex = Unset;
7601 unsigned PrecisionIndex = Unset;
7602
7603 // field width?
7604 const auto &FieldWidth = FS.getFieldWidth();
7605 if (!FieldWidth.isInvalid() && FieldWidth.hasDataArgument()) {
7606 FieldWidthIndex = Specs.size();
7607 Specs.emplace_back(Args: getSpecifierRange(startSpecifier, specifierLen),
7608 Args: getLocationOfByte(x: FieldWidth.getStart()),
7609 Args: analyze_format_string::LengthModifier::None, Args: "*",
7610 Args: FieldWidth.getArgType(Ctx&: S.Context),
7611 Args: EquatableFormatArgument::FAR_FieldWidth,
7612 Args: EquatableFormatArgument::SS_None,
7613 Args: FieldWidth.usesPositionalArg()
7614 ? FieldWidth.getPositionalArgIndex() - 1
7615 : FieldWidthIndex,
7616 Args: 0);
7617 }
7618 // precision?
7619 const auto &Precision = FS.getPrecision();
7620 if (!Precision.isInvalid() && Precision.hasDataArgument()) {
7621 PrecisionIndex = Specs.size();
7622 Specs.emplace_back(
7623 Args: getSpecifierRange(startSpecifier, specifierLen),
7624 Args: getLocationOfByte(x: Precision.getStart()),
7625 Args: analyze_format_string::LengthModifier::None, Args: ".*",
7626 Args: Precision.getArgType(Ctx&: S.Context), Args: EquatableFormatArgument::FAR_Precision,
7627 Args: EquatableFormatArgument::SS_None,
7628 Args: Precision.usesPositionalArg() ? Precision.getPositionalArgIndex() - 1
7629 : PrecisionIndex,
7630 Args: 0);
7631 }
7632
7633 // this specifier
7634 unsigned SpecIndex =
7635 FS.usesPositionalArg() ? FS.getPositionalArgIndex() - 1 : Specs.size();
7636 if (FieldWidthIndex != Unset)
7637 Specs[FieldWidthIndex].setModifierFor(SpecIndex);
7638 if (PrecisionIndex != Unset)
7639 Specs[PrecisionIndex].setModifierFor(SpecIndex);
7640
7641 EquatableFormatArgument::SpecifierSensitivity Sensitivity;
7642 if (FS.isPrivate())
7643 Sensitivity = EquatableFormatArgument::SS_Private;
7644 else if (FS.isPublic())
7645 Sensitivity = EquatableFormatArgument::SS_Public;
7646 else if (FS.isSensitive())
7647 Sensitivity = EquatableFormatArgument::SS_Sensitive;
7648 else
7649 Sensitivity = EquatableFormatArgument::SS_None;
7650
7651 Specs.emplace_back(
7652 Args: getSpecifierRange(startSpecifier, specifierLen),
7653 Args: getLocationOfByte(x: CS.getStart()), Args: FS.getLengthModifier().getKind(),
7654 Args: CS.getCharacters(), Args: FS.getArgType(Ctx&: S.Context, IsObjCLiteral: isObjCContext()),
7655 Args: EquatableFormatArgument::FAR_Data, Args&: Sensitivity, Args&: SpecIndex, Args: 0);
7656
7657 // auxiliary argument?
7658 if (CS.getKind() == analyze_format_string::ConversionSpecifier::FreeBSDbArg ||
7659 CS.getKind() == analyze_format_string::ConversionSpecifier::FreeBSDDArg) {
7660 Specs.emplace_back(Args: getSpecifierRange(startSpecifier, specifierLen),
7661 Args: getLocationOfByte(x: CS.getStart()),
7662 Args: analyze_format_string::LengthModifier::None,
7663 Args: CS.getCharacters(),
7664 Args: analyze_format_string::ArgType::CStrTy,
7665 Args: EquatableFormatArgument::FAR_Auxiliary, Args&: Sensitivity,
7666 Args: SpecIndex + 1, Args&: SpecIndex);
7667 }
7668 return true;
7669}
7670
7671// Determines if the specified is a C++ class or struct containing
7672// a member with the specified name and kind (e.g. a CXXMethodDecl named
7673// "c_str()").
7674template<typename MemberKind>
7675static llvm::SmallPtrSet<MemberKind*, 1>
7676CXXRecordMembersNamed(StringRef Name, Sema &S, QualType Ty) {
7677 const RecordType *RT = Ty->getAs<RecordType>();
7678 llvm::SmallPtrSet<MemberKind*, 1> Results;
7679
7680 if (!RT)
7681 return Results;
7682 const CXXRecordDecl *RD = dyn_cast<CXXRecordDecl>(Val: RT->getDecl());
7683 if (!RD || !RD->getDefinition())
7684 return Results;
7685
7686 LookupResult R(S, &S.Context.Idents.get(Name), SourceLocation(),
7687 Sema::LookupMemberName);
7688 R.suppressDiagnostics();
7689
7690 // We just need to include all members of the right kind turned up by the
7691 // filter, at this point.
7692 if (S.LookupQualifiedName(R, RT->getDecl()))
7693 for (LookupResult::iterator I = R.begin(), E = R.end(); I != E; ++I) {
7694 NamedDecl *decl = (*I)->getUnderlyingDecl();
7695 if (MemberKind *FK = dyn_cast<MemberKind>(decl))
7696 Results.insert(FK);
7697 }
7698 return Results;
7699}
7700
7701/// Check if we could call '.c_str()' on an object.
7702///
7703/// FIXME: This returns the wrong results in some cases (if cv-qualifiers don't
7704/// allow the call, or if it would be ambiguous).
7705bool Sema::hasCStrMethod(const Expr *E) {
7706 using MethodSet = llvm::SmallPtrSet<CXXMethodDecl *, 1>;
7707
7708 MethodSet Results =
7709 CXXRecordMembersNamed<CXXMethodDecl>(Name: "c_str", S&: *this, Ty: E->getType());
7710 for (MethodSet::iterator MI = Results.begin(), ME = Results.end();
7711 MI != ME; ++MI)
7712 if ((*MI)->getMinRequiredArguments() == 0)
7713 return true;
7714 return false;
7715}
7716
7717// Check if a (w)string was passed when a (w)char* was needed, and offer a
7718// better diagnostic if so. AT is assumed to be valid.
7719// Returns true when a c_str() conversion method is found.
7720bool CheckPrintfHandler::checkForCStrMembers(
7721 const analyze_printf::ArgType &AT, const Expr *E) {
7722 using MethodSet = llvm::SmallPtrSet<CXXMethodDecl *, 1>;
7723
7724 MethodSet Results =
7725 CXXRecordMembersNamed<CXXMethodDecl>(Name: "c_str", S, Ty: E->getType());
7726
7727 for (MethodSet::iterator MI = Results.begin(), ME = Results.end();
7728 MI != ME; ++MI) {
7729 const CXXMethodDecl *Method = *MI;
7730 if (Method->getMinRequiredArguments() == 0 &&
7731 AT.matchesType(C&: S.Context, argTy: Method->getReturnType())) {
7732 // FIXME: Suggest parens if the expression needs them.
7733 SourceLocation EndLoc = S.getLocForEndOfToken(Loc: E->getEndLoc());
7734 S.Diag(E->getBeginLoc(), diag::note_printf_c_str)
7735 << "c_str()" << FixItHint::CreateInsertion(EndLoc, ".c_str()");
7736 return true;
7737 }
7738 }
7739
7740 return false;
7741}
7742
7743bool CheckPrintfHandler::HandlePrintfSpecifier(
7744 const analyze_printf::PrintfSpecifier &FS, const char *startSpecifier,
7745 unsigned specifierLen, const TargetInfo &Target) {
7746 using namespace analyze_format_string;
7747 using namespace analyze_printf;
7748
7749 const PrintfConversionSpecifier &CS = FS.getConversionSpecifier();
7750
7751 if (FS.consumesDataArgument()) {
7752 if (atFirstArg) {
7753 atFirstArg = false;
7754 usesPositionalArgs = FS.usesPositionalArg();
7755 }
7756 else if (usesPositionalArgs != FS.usesPositionalArg()) {
7757 HandlePositionalNonpositionalArgs(Loc: getLocationOfByte(x: CS.getStart()),
7758 startSpec: startSpecifier, specifierLen);
7759 return false;
7760 }
7761 }
7762
7763 // First check if the field width, precision, and conversion specifier
7764 // have matching data arguments.
7765 if (!HandleAmount(Amt: FS.getFieldWidth(), /* field width */ k: 0,
7766 startSpecifier, specifierLen)) {
7767 return false;
7768 }
7769
7770 if (!HandleAmount(Amt: FS.getPrecision(), /* precision */ k: 1,
7771 startSpecifier, specifierLen)) {
7772 return false;
7773 }
7774
7775 if (!CS.consumesDataArgument()) {
7776 // FIXME: Technically specifying a precision or field width here
7777 // makes no sense. Worth issuing a warning at some point.
7778 return true;
7779 }
7780
7781 // Consume the argument.
7782 unsigned argIndex = FS.getArgIndex();
7783 if (argIndex < NumDataArgs) {
7784 // The check to see if the argIndex is valid will come later.
7785 // We set the bit here because we may exit early from this
7786 // function if we encounter some other error.
7787 CoveredArgs.set(argIndex);
7788 }
7789
7790 // FreeBSD kernel extensions.
7791 if (CS.getKind() == ConversionSpecifier::FreeBSDbArg ||
7792 CS.getKind() == ConversionSpecifier::FreeBSDDArg) {
7793 // We need at least two arguments.
7794 if (!CheckNumArgs(FS, CS, startSpecifier, specifierLen, argIndex: argIndex + 1))
7795 return false;
7796
7797 if (HasFormatArguments()) {
7798 // Claim the second argument.
7799 CoveredArgs.set(argIndex + 1);
7800
7801 // Type check the first argument (int for %b, pointer for %D)
7802 const Expr *Ex = getDataArg(i: argIndex);
7803 const analyze_printf::ArgType &AT =
7804 (CS.getKind() == ConversionSpecifier::FreeBSDbArg)
7805 ? ArgType(S.Context.IntTy)
7806 : ArgType::CPointerTy;
7807 if (AT.isValid() && !AT.matchesType(S.Context, Ex->getType()))
7808 EmitFormatDiagnostic(
7809 S.PDiag(diag::warn_format_conversion_argument_type_mismatch)
7810 << AT.getRepresentativeTypeName(S.Context) << Ex->getType()
7811 << false << Ex->getSourceRange(),
7812 Ex->getBeginLoc(), /*IsStringLocation*/ false,
7813 getSpecifierRange(startSpecifier, specifierLen));
7814
7815 // Type check the second argument (char * for both %b and %D)
7816 Ex = getDataArg(i: argIndex + 1);
7817 const analyze_printf::ArgType &AT2 = ArgType::CStrTy;
7818 if (AT2.isValid() && !AT2.matchesType(S.Context, Ex->getType()))
7819 EmitFormatDiagnostic(
7820 S.PDiag(diag::warn_format_conversion_argument_type_mismatch)
7821 << AT2.getRepresentativeTypeName(S.Context) << Ex->getType()
7822 << false << Ex->getSourceRange(),
7823 Ex->getBeginLoc(), /*IsStringLocation*/ false,
7824 getSpecifierRange(startSpecifier, specifierLen));
7825 }
7826 return true;
7827 }
7828
7829 // Check for using an Objective-C specific conversion specifier
7830 // in a non-ObjC literal.
7831 if (!allowsObjCArg() && CS.isObjCArg()) {
7832 return HandleInvalidPrintfConversionSpecifier(FS, startSpecifier,
7833 specifierLen);
7834 }
7835
7836 // %P can only be used with os_log.
7837 if (FSType != FormatStringType::OSLog &&
7838 CS.getKind() == ConversionSpecifier::PArg) {
7839 return HandleInvalidPrintfConversionSpecifier(FS, startSpecifier,
7840 specifierLen);
7841 }
7842
7843 // %n is not allowed with os_log.
7844 if (FSType == FormatStringType::OSLog &&
7845 CS.getKind() == ConversionSpecifier::nArg) {
7846 EmitFormatDiagnostic(S.PDiag(diag::warn_os_log_format_narg),
7847 getLocationOfByte(CS.getStart()),
7848 /*IsStringLocation*/ false,
7849 getSpecifierRange(startSpecifier, specifierLen));
7850
7851 return true;
7852 }
7853
7854 // Only scalars are allowed for os_trace.
7855 if (FSType == FormatStringType::OSTrace &&
7856 (CS.getKind() == ConversionSpecifier::PArg ||
7857 CS.getKind() == ConversionSpecifier::sArg ||
7858 CS.getKind() == ConversionSpecifier::ObjCObjArg)) {
7859 return HandleInvalidPrintfConversionSpecifier(FS, startSpecifier,
7860 specifierLen);
7861 }
7862
7863 // Check for use of public/private annotation outside of os_log().
7864 if (FSType != FormatStringType::OSLog) {
7865 if (FS.isPublic().isSet()) {
7866 EmitFormatDiagnostic(S.PDiag(diag::warn_format_invalid_annotation)
7867 << "public",
7868 getLocationOfByte(FS.isPublic().getPosition()),
7869 /*IsStringLocation*/ false,
7870 getSpecifierRange(startSpecifier, specifierLen));
7871 }
7872 if (FS.isPrivate().isSet()) {
7873 EmitFormatDiagnostic(S.PDiag(diag::warn_format_invalid_annotation)
7874 << "private",
7875 getLocationOfByte(FS.isPrivate().getPosition()),
7876 /*IsStringLocation*/ false,
7877 getSpecifierRange(startSpecifier, specifierLen));
7878 }
7879 }
7880
7881 const llvm::Triple &Triple = Target.getTriple();
7882 if (CS.getKind() == ConversionSpecifier::nArg &&
7883 (Triple.isAndroid() || Triple.isOSFuchsia())) {
7884 EmitFormatDiagnostic(S.PDiag(diag::warn_printf_narg_not_supported),
7885 getLocationOfByte(CS.getStart()),
7886 /*IsStringLocation*/ false,
7887 getSpecifierRange(startSpecifier, specifierLen));
7888 }
7889
7890 // Check for invalid use of field width
7891 if (!FS.hasValidFieldWidth()) {
7892 HandleInvalidAmount(FS, Amt: FS.getFieldWidth(), /* field width */ type: 0,
7893 startSpecifier, specifierLen);
7894 }
7895
7896 // Check for invalid use of precision
7897 if (!FS.hasValidPrecision()) {
7898 HandleInvalidAmount(FS, Amt: FS.getPrecision(), /* precision */ type: 1,
7899 startSpecifier, specifierLen);
7900 }
7901
7902 // Precision is mandatory for %P specifier.
7903 if (CS.getKind() == ConversionSpecifier::PArg &&
7904 FS.getPrecision().getHowSpecified() == OptionalAmount::NotSpecified) {
7905 EmitFormatDiagnostic(S.PDiag(diag::warn_format_P_no_precision),
7906 getLocationOfByte(startSpecifier),
7907 /*IsStringLocation*/ false,
7908 getSpecifierRange(startSpecifier, specifierLen));
7909 }
7910
7911 // Check each flag does not conflict with any other component.
7912 if (!FS.hasValidThousandsGroupingPrefix())
7913 HandleFlag(FS, flag: FS.hasThousandsGrouping(), startSpecifier, specifierLen);
7914 if (!FS.hasValidLeadingZeros())
7915 HandleFlag(FS, flag: FS.hasLeadingZeros(), startSpecifier, specifierLen);
7916 if (!FS.hasValidPlusPrefix())
7917 HandleFlag(FS, flag: FS.hasPlusPrefix(), startSpecifier, specifierLen);
7918 if (!FS.hasValidSpacePrefix())
7919 HandleFlag(FS, flag: FS.hasSpacePrefix(), startSpecifier, specifierLen);
7920 if (!FS.hasValidAlternativeForm())
7921 HandleFlag(FS, flag: FS.hasAlternativeForm(), startSpecifier, specifierLen);
7922 if (!FS.hasValidLeftJustified())
7923 HandleFlag(FS, flag: FS.isLeftJustified(), startSpecifier, specifierLen);
7924
7925 // Check that flags are not ignored by another flag
7926 if (FS.hasSpacePrefix() && FS.hasPlusPrefix()) // ' ' ignored by '+'
7927 HandleIgnoredFlag(FS, ignoredFlag: FS.hasSpacePrefix(), flag: FS.hasPlusPrefix(),
7928 startSpecifier, specifierLen);
7929 if (FS.hasLeadingZeros() && FS.isLeftJustified()) // '0' ignored by '-'
7930 HandleIgnoredFlag(FS, ignoredFlag: FS.hasLeadingZeros(), flag: FS.isLeftJustified(),
7931 startSpecifier, specifierLen);
7932
7933 // Check the length modifier is valid with the given conversion specifier.
7934 if (!FS.hasValidLengthModifier(Target: S.getASTContext().getTargetInfo(),
7935 LO: S.getLangOpts()))
7936 HandleInvalidLengthModifier(FS, CS, startSpecifier, specifierLen,
7937 diag::warn_format_nonsensical_length);
7938 else if (!FS.hasStandardLengthModifier())
7939 HandleNonStandardLengthModifier(FS, startSpecifier, specifierLen);
7940 else if (!FS.hasStandardLengthConversionCombination())
7941 HandleInvalidLengthModifier(FS, CS, startSpecifier, specifierLen,
7942 diag::warn_format_non_standard_conversion_spec);
7943
7944 if (!FS.hasStandardConversionSpecifier(LangOpt: S.getLangOpts()))
7945 HandleNonStandardConversionSpecifier(CS, startSpecifier, specifierLen);
7946
7947 // The remaining checks depend on the data arguments.
7948 if (!HasFormatArguments())
7949 return true;
7950
7951 if (!CheckNumArgs(FS, CS, startSpecifier, specifierLen, argIndex))
7952 return false;
7953
7954 const Expr *Arg = getDataArg(i: argIndex);
7955 if (!Arg)
7956 return true;
7957
7958 return checkFormatExpr(FS, StartSpecifier: startSpecifier, SpecifierLen: specifierLen, E: Arg);
7959}
7960
7961static bool requiresParensToAddCast(const Expr *E) {
7962 // FIXME: We should have a general way to reason about operator
7963 // precedence and whether parens are actually needed here.
7964 // Take care of a few common cases where they aren't.
7965 const Expr *Inside = E->IgnoreImpCasts();
7966 if (const PseudoObjectExpr *POE = dyn_cast<PseudoObjectExpr>(Val: Inside))
7967 Inside = POE->getSyntacticForm()->IgnoreImpCasts();
7968
7969 switch (Inside->getStmtClass()) {
7970 case Stmt::ArraySubscriptExprClass:
7971 case Stmt::CallExprClass:
7972 case Stmt::CharacterLiteralClass:
7973 case Stmt::CXXBoolLiteralExprClass:
7974 case Stmt::DeclRefExprClass:
7975 case Stmt::FloatingLiteralClass:
7976 case Stmt::IntegerLiteralClass:
7977 case Stmt::MemberExprClass:
7978 case Stmt::ObjCArrayLiteralClass:
7979 case Stmt::ObjCBoolLiteralExprClass:
7980 case Stmt::ObjCBoxedExprClass:
7981 case Stmt::ObjCDictionaryLiteralClass:
7982 case Stmt::ObjCEncodeExprClass:
7983 case Stmt::ObjCIvarRefExprClass:
7984 case Stmt::ObjCMessageExprClass:
7985 case Stmt::ObjCPropertyRefExprClass:
7986 case Stmt::ObjCStringLiteralClass:
7987 case Stmt::ObjCSubscriptRefExprClass:
7988 case Stmt::ParenExprClass:
7989 case Stmt::StringLiteralClass:
7990 case Stmt::UnaryOperatorClass:
7991 return false;
7992 default:
7993 return true;
7994 }
7995}
7996
7997static std::pair<QualType, StringRef>
7998shouldNotPrintDirectly(const ASTContext &Context,
7999 QualType IntendedTy,
8000 const Expr *E) {
8001 // Use a 'while' to peel off layers of typedefs.
8002 QualType TyTy = IntendedTy;
8003 while (const TypedefType *UserTy = TyTy->getAs<TypedefType>()) {
8004 StringRef Name = UserTy->getDecl()->getName();
8005 QualType CastTy = llvm::StringSwitch<QualType>(Name)
8006 .Case(S: "CFIndex", Value: Context.getNSIntegerType())
8007 .Case(S: "NSInteger", Value: Context.getNSIntegerType())
8008 .Case(S: "NSUInteger", Value: Context.getNSUIntegerType())
8009 .Case(S: "SInt32", Value: Context.IntTy)
8010 .Case("UInt32", Context.UnsignedIntTy)
8011 .Default(QualType());
8012
8013 if (!CastTy.isNull())
8014 return std::make_pair(x&: CastTy, y&: Name);
8015
8016 TyTy = UserTy->desugar();
8017 }
8018
8019 // Strip parens if necessary.
8020 if (const ParenExpr *PE = dyn_cast<ParenExpr>(E))
8021 return shouldNotPrintDirectly(Context,
8022 PE->getSubExpr()->getType(),
8023 PE->getSubExpr());
8024
8025 // If this is a conditional expression, then its result type is constructed
8026 // via usual arithmetic conversions and thus there might be no necessary
8027 // typedef sugar there. Recurse to operands to check for NSInteger &
8028 // Co. usage condition.
8029 if (const ConditionalOperator *CO = dyn_cast<ConditionalOperator>(Val: E)) {
8030 QualType TrueTy, FalseTy;
8031 StringRef TrueName, FalseName;
8032
8033 std::tie(TrueTy, TrueName) =
8034 shouldNotPrintDirectly(Context,
8035 CO->getTrueExpr()->getType(),
8036 CO->getTrueExpr());
8037 std::tie(FalseTy, FalseName) =
8038 shouldNotPrintDirectly(Context,
8039 CO->getFalseExpr()->getType(),
8040 CO->getFalseExpr());
8041
8042 if (TrueTy == FalseTy)
8043 return std::make_pair(x&: TrueTy, y&: TrueName);
8044 else if (TrueTy.isNull())
8045 return std::make_pair(x&: FalseTy, y&: FalseName);
8046 else if (FalseTy.isNull())
8047 return std::make_pair(x&: TrueTy, y&: TrueName);
8048 }
8049
8050 return std::make_pair(x: QualType(), y: StringRef());
8051}
8052
8053/// Return true if \p ICE is an implicit argument promotion of an arithmetic
8054/// type. Bit-field 'promotions' from a higher ranked type to a lower ranked
8055/// type do not count.
8056static bool
8057isArithmeticArgumentPromotion(Sema &S, const ImplicitCastExpr *ICE) {
8058 QualType From = ICE->getSubExpr()->getType();
8059 QualType To = ICE->getType();
8060 // It's an integer promotion if the destination type is the promoted
8061 // source type.
8062 if (ICE->getCastKind() == CK_IntegralCast &&
8063 S.Context.isPromotableIntegerType(T: From) &&
8064 S.Context.getPromotedIntegerType(PromotableType: From) == To)
8065 return true;
8066 // Look through vector types, since we do default argument promotion for
8067 // those in OpenCL.
8068 if (const auto *VecTy = From->getAs<ExtVectorType>())
8069 From = VecTy->getElementType();
8070 if (const auto *VecTy = To->getAs<ExtVectorType>())
8071 To = VecTy->getElementType();
8072 // It's a floating promotion if the source type is a lower rank.
8073 return ICE->getCastKind() == CK_FloatingCast &&
8074 S.Context.getFloatingTypeOrder(LHS: From, RHS: To) < 0;
8075}
8076
8077static analyze_format_string::ArgType::MatchKind
8078handleFormatSignedness(analyze_format_string::ArgType::MatchKind Match,
8079 DiagnosticsEngine &Diags, SourceLocation Loc) {
8080 if (Match == analyze_format_string::ArgType::NoMatchSignedness) {
8081 Match =
8082 Diags.isIgnored(
8083 diag::warn_format_conversion_argument_type_mismatch_signedness, Loc)
8084 ? analyze_format_string::ArgType::Match
8085 : analyze_format_string::ArgType::NoMatch;
8086 }
8087 return Match;
8088}
8089
8090bool
8091CheckPrintfHandler::checkFormatExpr(const analyze_printf::PrintfSpecifier &FS,
8092 const char *StartSpecifier,
8093 unsigned SpecifierLen,
8094 const Expr *E) {
8095 using namespace analyze_format_string;
8096 using namespace analyze_printf;
8097
8098 // Now type check the data expression that matches the
8099 // format specifier.
8100 const analyze_printf::ArgType &AT = FS.getArgType(Ctx&: S.Context, IsObjCLiteral: isObjCContext());
8101 if (!AT.isValid())
8102 return true;
8103
8104 QualType ExprTy = E->getType();
8105 while (const TypeOfExprType *TET = dyn_cast<TypeOfExprType>(Val&: ExprTy)) {
8106 ExprTy = TET->getUnderlyingExpr()->getType();
8107 }
8108
8109 // When using the format attribute in C++, you can receive a function or an
8110 // array that will necessarily decay to a pointer when passed to the final
8111 // format consumer. Apply decay before type comparison.
8112 if (ExprTy->canDecayToPointerType())
8113 ExprTy = S.Context.getDecayedType(T: ExprTy);
8114
8115 // Diagnose attempts to print a boolean value as a character. Unlike other
8116 // -Wformat diagnostics, this is fine from a type perspective, but it still
8117 // doesn't make sense.
8118 if (FS.getConversionSpecifier().getKind() == ConversionSpecifier::cArg &&
8119 E->isKnownToHaveBooleanValue()) {
8120 const CharSourceRange &CSR =
8121 getSpecifierRange(startSpecifier: StartSpecifier, specifierLen: SpecifierLen);
8122 SmallString<4> FSString;
8123 llvm::raw_svector_ostream os(FSString);
8124 FS.toString(os);
8125 EmitFormatDiagnostic(S.PDiag(diag::warn_format_bool_as_character)
8126 << FSString,
8127 E->getExprLoc(), false, CSR);
8128 return true;
8129 }
8130
8131 // Diagnose attempts to use '%P' with ObjC object types, which will result in
8132 // dumping raw class data (like is-a pointer), not actual data.
8133 if (FS.getConversionSpecifier().getKind() == ConversionSpecifier::PArg &&
8134 ExprTy->isObjCObjectPointerType()) {
8135 const CharSourceRange &CSR =
8136 getSpecifierRange(startSpecifier: StartSpecifier, specifierLen: SpecifierLen);
8137 EmitFormatDiagnostic(S.PDiag(diag::warn_format_P_with_objc_pointer),
8138 E->getExprLoc(), false, CSR);
8139 return true;
8140 }
8141
8142 ArgType::MatchKind ImplicitMatch = ArgType::NoMatch;
8143 ArgType::MatchKind Match = AT.matchesType(C&: S.Context, argTy: ExprTy);
8144 ArgType::MatchKind OrigMatch = Match;
8145
8146 Match = handleFormatSignedness(Match, Diags&: S.getDiagnostics(), Loc: E->getExprLoc());
8147 if (Match == ArgType::Match)
8148 return true;
8149
8150 // NoMatchPromotionTypeConfusion should be only returned in ImplictCastExpr
8151 assert(Match != ArgType::NoMatchPromotionTypeConfusion);
8152
8153 // Look through argument promotions for our error message's reported type.
8154 // This includes the integral and floating promotions, but excludes array
8155 // and function pointer decay (seeing that an argument intended to be a
8156 // string has type 'char [6]' is probably more confusing than 'char *') and
8157 // certain bitfield promotions (bitfields can be 'demoted' to a lesser type).
8158 if (const ImplicitCastExpr *ICE = dyn_cast<ImplicitCastExpr>(Val: E)) {
8159 if (isArithmeticArgumentPromotion(S, ICE)) {
8160 E = ICE->getSubExpr();
8161 ExprTy = E->getType();
8162
8163 // Check if we didn't match because of an implicit cast from a 'char'
8164 // or 'short' to an 'int'. This is done because printf is a varargs
8165 // function.
8166 if (ICE->getType() == S.Context.IntTy ||
8167 ICE->getType() == S.Context.UnsignedIntTy) {
8168 // All further checking is done on the subexpression
8169 ImplicitMatch = AT.matchesType(C&: S.Context, argTy: ExprTy);
8170 if (OrigMatch == ArgType::NoMatchSignedness &&
8171 ImplicitMatch != ArgType::NoMatchSignedness)
8172 // If the original match was a signedness match this match on the
8173 // implicit cast type also need to be signedness match otherwise we
8174 // might introduce new unexpected warnings from -Wformat-signedness.
8175 return true;
8176 ImplicitMatch = handleFormatSignedness(
8177 Match: ImplicitMatch, Diags&: S.getDiagnostics(), Loc: E->getExprLoc());
8178 if (ImplicitMatch == ArgType::Match)
8179 return true;
8180 }
8181 }
8182 } else if (const CharacterLiteral *CL = dyn_cast<CharacterLiteral>(Val: E)) {
8183 // Special case for 'a', which has type 'int' in C.
8184 // Note, however, that we do /not/ want to treat multibyte constants like
8185 // 'MooV' as characters! This form is deprecated but still exists. In
8186 // addition, don't treat expressions as of type 'char' if one byte length
8187 // modifier is provided.
8188 if (ExprTy == S.Context.IntTy &&
8189 FS.getLengthModifier().getKind() != LengthModifier::AsChar)
8190 if (llvm::isUIntN(N: S.Context.getCharWidth(), x: CL->getValue())) {
8191 ExprTy = S.Context.CharTy;
8192 // To improve check results, we consider a character literal in C
8193 // to be a 'char' rather than an 'int'. 'printf("%hd", 'a');' is
8194 // more likely a type confusion situation, so we will suggest to
8195 // use '%hhd' instead by discarding the MatchPromotion.
8196 if (Match == ArgType::MatchPromotion)
8197 Match = ArgType::NoMatch;
8198 }
8199 }
8200 if (Match == ArgType::MatchPromotion) {
8201 // WG14 N2562 only clarified promotions in *printf
8202 // For NSLog in ObjC, just preserve -Wformat behavior
8203 if (!S.getLangOpts().ObjC &&
8204 ImplicitMatch != ArgType::NoMatchPromotionTypeConfusion &&
8205 ImplicitMatch != ArgType::NoMatchTypeConfusion)
8206 return true;
8207 Match = ArgType::NoMatch;
8208 }
8209 if (ImplicitMatch == ArgType::NoMatchPedantic ||
8210 ImplicitMatch == ArgType::NoMatchTypeConfusion)
8211 Match = ImplicitMatch;
8212 assert(Match != ArgType::MatchPromotion);
8213
8214 // Look through unscoped enums to their underlying type.
8215 bool IsEnum = false;
8216 bool IsScopedEnum = false;
8217 QualType IntendedTy = ExprTy;
8218 if (auto EnumTy = ExprTy->getAs<EnumType>()) {
8219 IntendedTy = EnumTy->getDecl()->getIntegerType();
8220 if (EnumTy->isUnscopedEnumerationType()) {
8221 ExprTy = IntendedTy;
8222 // This controls whether we're talking about the underlying type or not,
8223 // which we only want to do when it's an unscoped enum.
8224 IsEnum = true;
8225 } else {
8226 IsScopedEnum = true;
8227 }
8228 }
8229
8230 // %C in an Objective-C context prints a unichar, not a wchar_t.
8231 // If the argument is an integer of some kind, believe the %C and suggest
8232 // a cast instead of changing the conversion specifier.
8233 if (isObjCContext() &&
8234 FS.getConversionSpecifier().getKind() == ConversionSpecifier::CArg) {
8235 if (ExprTy->isIntegralOrUnscopedEnumerationType() &&
8236 !ExprTy->isCharType()) {
8237 // 'unichar' is defined as a typedef of unsigned short, but we should
8238 // prefer using the typedef if it is visible.
8239 IntendedTy = S.Context.UnsignedShortTy;
8240
8241 // While we are here, check if the value is an IntegerLiteral that happens
8242 // to be within the valid range.
8243 if (const IntegerLiteral *IL = dyn_cast<IntegerLiteral>(Val: E)) {
8244 const llvm::APInt &V = IL->getValue();
8245 if (V.getActiveBits() <= S.Context.getTypeSize(T: IntendedTy))
8246 return true;
8247 }
8248
8249 LookupResult Result(S, &S.Context.Idents.get(Name: "unichar"), E->getBeginLoc(),
8250 Sema::LookupOrdinaryName);
8251 if (S.LookupName(R&: Result, S: S.getCurScope())) {
8252 NamedDecl *ND = Result.getFoundDecl();
8253 if (TypedefNameDecl *TD = dyn_cast<TypedefNameDecl>(Val: ND))
8254 if (TD->getUnderlyingType() == IntendedTy)
8255 IntendedTy = S.Context.getTypedefType(Decl: TD);
8256 }
8257 }
8258 }
8259
8260 // Special-case some of Darwin's platform-independence types by suggesting
8261 // casts to primitive types that are known to be large enough.
8262 bool ShouldNotPrintDirectly = false; StringRef CastTyName;
8263 if (S.Context.getTargetInfo().getTriple().isOSDarwin()) {
8264 QualType CastTy;
8265 std::tie(CastTy, CastTyName) = shouldNotPrintDirectly(S.Context, IntendedTy, E);
8266 if (!CastTy.isNull()) {
8267 // %zi/%zu and %td/%tu are OK to use for NSInteger/NSUInteger of type int
8268 // (long in ASTContext). Only complain to pedants or when they're the
8269 // underlying type of a scoped enum (which always needs a cast).
8270 if (!IsScopedEnum &&
8271 (CastTyName == "NSInteger" || CastTyName == "NSUInteger") &&
8272 (AT.isSizeT() || AT.isPtrdiffT()) &&
8273 AT.matchesType(C&: S.Context, argTy: CastTy))
8274 Match = ArgType::NoMatchPedantic;
8275 IntendedTy = CastTy;
8276 ShouldNotPrintDirectly = true;
8277 }
8278 }
8279
8280 // We may be able to offer a FixItHint if it is a supported type.
8281 PrintfSpecifier fixedFS = FS;
8282 bool Success =
8283 fixedFS.fixType(QT: IntendedTy, LangOpt: S.getLangOpts(), Ctx&: S.Context, IsObjCLiteral: isObjCContext());
8284
8285 if (Success) {
8286 // Get the fix string from the fixed format specifier
8287 SmallString<16> buf;
8288 llvm::raw_svector_ostream os(buf);
8289 fixedFS.toString(os);
8290
8291 CharSourceRange SpecRange = getSpecifierRange(startSpecifier: StartSpecifier, specifierLen: SpecifierLen);
8292
8293 if (IntendedTy == ExprTy && !ShouldNotPrintDirectly && !IsScopedEnum) {
8294 unsigned Diag;
8295 switch (Match) {
8296 case ArgType::Match:
8297 case ArgType::MatchPromotion:
8298 case ArgType::NoMatchPromotionTypeConfusion:
8299 case ArgType::NoMatchSignedness:
8300 llvm_unreachable("expected non-matching");
8301 case ArgType::NoMatchPedantic:
8302 Diag = diag::warn_format_conversion_argument_type_mismatch_pedantic;
8303 break;
8304 case ArgType::NoMatchTypeConfusion:
8305 Diag = diag::warn_format_conversion_argument_type_mismatch_confusion;
8306 break;
8307 case ArgType::NoMatch:
8308 Diag = diag::warn_format_conversion_argument_type_mismatch;
8309 break;
8310 }
8311
8312 // In this case, the specifier is wrong and should be changed to match
8313 // the argument.
8314 EmitFormatDiagnostic(S.PDiag(Diag)
8315 << AT.getRepresentativeTypeName(C&: S.Context)
8316 << IntendedTy << IsEnum << E->getSourceRange(),
8317 E->getBeginLoc(),
8318 /*IsStringLocation*/ false, SpecRange,
8319 FixItHint::CreateReplacement(RemoveRange: SpecRange, Code: os.str()));
8320 } else {
8321 // The canonical type for formatting this value is different from the
8322 // actual type of the expression. (This occurs, for example, with Darwin's
8323 // NSInteger on 32-bit platforms, where it is typedef'd as 'int', but
8324 // should be printed as 'long' for 64-bit compatibility.)
8325 // Rather than emitting a normal format/argument mismatch, we want to
8326 // add a cast to the recommended type (and correct the format string
8327 // if necessary). We should also do so for scoped enumerations.
8328 SmallString<16> CastBuf;
8329 llvm::raw_svector_ostream CastFix(CastBuf);
8330 CastFix << (S.LangOpts.CPlusPlus ? "static_cast<" : "(");
8331 IntendedTy.print(OS&: CastFix, Policy: S.Context.getPrintingPolicy());
8332 CastFix << (S.LangOpts.CPlusPlus ? ">" : ")");
8333
8334 SmallVector<FixItHint,4> Hints;
8335 ArgType::MatchKind IntendedMatch = AT.matchesType(C&: S.Context, argTy: IntendedTy);
8336 IntendedMatch = handleFormatSignedness(Match: IntendedMatch, Diags&: S.getDiagnostics(),
8337 Loc: E->getExprLoc());
8338 if ((IntendedMatch != ArgType::Match) || ShouldNotPrintDirectly)
8339 Hints.push_back(Elt: FixItHint::CreateReplacement(RemoveRange: SpecRange, Code: os.str()));
8340
8341 if (const CStyleCastExpr *CCast = dyn_cast<CStyleCastExpr>(Val: E)) {
8342 // If there's already a cast present, just replace it.
8343 SourceRange CastRange(CCast->getLParenLoc(), CCast->getRParenLoc());
8344 Hints.push_back(Elt: FixItHint::CreateReplacement(RemoveRange: CastRange, Code: CastFix.str()));
8345
8346 } else if (!requiresParensToAddCast(E) && !S.LangOpts.CPlusPlus) {
8347 // If the expression has high enough precedence,
8348 // just write the C-style cast.
8349 Hints.push_back(
8350 FixItHint::CreateInsertion(InsertionLoc: E->getBeginLoc(), Code: CastFix.str()));
8351 } else {
8352 // Otherwise, add parens around the expression as well as the cast.
8353 CastFix << "(";
8354 Hints.push_back(
8355 FixItHint::CreateInsertion(InsertionLoc: E->getBeginLoc(), Code: CastFix.str()));
8356
8357 // We don't use getLocForEndOfToken because it returns invalid source
8358 // locations for macro expansions (by design).
8359 SourceLocation EndLoc = S.SourceMgr.getSpellingLoc(Loc: E->getEndLoc());
8360 SourceLocation After = EndLoc.getLocWithOffset(
8361 Offset: Lexer::MeasureTokenLength(Loc: EndLoc, SM: S.SourceMgr, LangOpts: S.LangOpts));
8362 Hints.push_back(Elt: FixItHint::CreateInsertion(InsertionLoc: After, Code: ")"));
8363 }
8364
8365 if (ShouldNotPrintDirectly && !IsScopedEnum) {
8366 // The expression has a type that should not be printed directly.
8367 // We extract the name from the typedef because we don't want to show
8368 // the underlying type in the diagnostic.
8369 StringRef Name;
8370 if (const auto *TypedefTy = ExprTy->getAs<TypedefType>())
8371 Name = TypedefTy->getDecl()->getName();
8372 else
8373 Name = CastTyName;
8374 unsigned Diag = Match == ArgType::NoMatchPedantic
8375 ? diag::warn_format_argument_needs_cast_pedantic
8376 : diag::warn_format_argument_needs_cast;
8377 EmitFormatDiagnostic(S.PDiag(Diag) << Name << IntendedTy << IsEnum
8378 << E->getSourceRange(),
8379 E->getBeginLoc(), /*IsStringLocation=*/false,
8380 SpecRange, Hints);
8381 } else {
8382 // In this case, the expression could be printed using a different
8383 // specifier, but we've decided that the specifier is probably correct
8384 // and we should cast instead. Just use the normal warning message.
8385
8386 unsigned Diag =
8387 IsScopedEnum
8388 ? diag::warn_format_conversion_argument_type_mismatch_pedantic
8389 : diag::warn_format_conversion_argument_type_mismatch;
8390
8391 EmitFormatDiagnostic(
8392 S.PDiag(Diag) << AT.getRepresentativeTypeName(C&: S.Context) << ExprTy
8393 << IsEnum << E->getSourceRange(),
8394 E->getBeginLoc(), /*IsStringLocation*/ false, SpecRange, Hints);
8395 }
8396 }
8397 } else {
8398 const CharSourceRange &CSR = getSpecifierRange(startSpecifier: StartSpecifier,
8399 specifierLen: SpecifierLen);
8400 // Since the warning for passing non-POD types to variadic functions
8401 // was deferred until now, we emit a warning for non-POD
8402 // arguments here.
8403 bool EmitTypeMismatch = false;
8404 switch (S.isValidVarArgType(Ty: ExprTy)) {
8405 case VarArgKind::Valid:
8406 case VarArgKind::ValidInCXX11: {
8407 unsigned Diag;
8408 switch (Match) {
8409 case ArgType::Match:
8410 case ArgType::MatchPromotion:
8411 case ArgType::NoMatchPromotionTypeConfusion:
8412 case ArgType::NoMatchSignedness:
8413 llvm_unreachable("expected non-matching");
8414 case ArgType::NoMatchPedantic:
8415 Diag = diag::warn_format_conversion_argument_type_mismatch_pedantic;
8416 break;
8417 case ArgType::NoMatchTypeConfusion:
8418 Diag = diag::warn_format_conversion_argument_type_mismatch_confusion;
8419 break;
8420 case ArgType::NoMatch:
8421 Diag = diag::warn_format_conversion_argument_type_mismatch;
8422 break;
8423 }
8424
8425 EmitFormatDiagnostic(
8426 S.PDiag(Diag) << AT.getRepresentativeTypeName(C&: S.Context) << ExprTy
8427 << IsEnum << CSR << E->getSourceRange(),
8428 E->getBeginLoc(), /*IsStringLocation*/ false, CSR);
8429 break;
8430 }
8431 case VarArgKind::Undefined:
8432 case VarArgKind::MSVCUndefined:
8433 if (CallType == VariadicCallType::DoesNotApply) {
8434 EmitTypeMismatch = true;
8435 } else {
8436 EmitFormatDiagnostic(
8437 S.PDiag(diag::warn_non_pod_vararg_with_format_string)
8438 << S.getLangOpts().CPlusPlus11 << ExprTy << CallType
8439 << AT.getRepresentativeTypeName(S.Context) << CSR
8440 << E->getSourceRange(),
8441 E->getBeginLoc(), /*IsStringLocation*/ false, CSR);
8442 checkForCStrMembers(AT, E);
8443 }
8444 break;
8445
8446 case VarArgKind::Invalid:
8447 if (CallType == VariadicCallType::DoesNotApply)
8448 EmitTypeMismatch = true;
8449 else if (ExprTy->isObjCObjectType())
8450 EmitFormatDiagnostic(
8451 S.PDiag(diag::err_cannot_pass_objc_interface_to_vararg_format)
8452 << S.getLangOpts().CPlusPlus11 << ExprTy << CallType
8453 << AT.getRepresentativeTypeName(S.Context) << CSR
8454 << E->getSourceRange(),
8455 E->getBeginLoc(), /*IsStringLocation*/ false, CSR);
8456 else
8457 // FIXME: If this is an initializer list, suggest removing the braces
8458 // or inserting a cast to the target type.
8459 S.Diag(E->getBeginLoc(), diag::err_cannot_pass_to_vararg_format)
8460 << isa<InitListExpr>(E) << ExprTy << CallType
8461 << AT.getRepresentativeTypeName(S.Context) << E->getSourceRange();
8462 break;
8463 }
8464
8465 if (EmitTypeMismatch) {
8466 // The function is not variadic, so we do not generate warnings about
8467 // being allowed to pass that object as a variadic argument. Instead,
8468 // since there are inherently no printf specifiers for types which cannot
8469 // be passed as variadic arguments, emit a plain old specifier mismatch
8470 // argument.
8471 EmitFormatDiagnostic(
8472 S.PDiag(diag::warn_format_conversion_argument_type_mismatch)
8473 << AT.getRepresentativeTypeName(S.Context) << ExprTy << false
8474 << E->getSourceRange(),
8475 E->getBeginLoc(), false, CSR);
8476 }
8477
8478 assert(FirstDataArg + FS.getArgIndex() < CheckedVarArgs.size() &&
8479 "format string specifier index out of range");
8480 CheckedVarArgs[FirstDataArg + FS.getArgIndex()] = true;
8481 }
8482
8483 return true;
8484}
8485
8486//===--- CHECK: Scanf format string checking ------------------------------===//
8487
8488namespace {
8489
8490class CheckScanfHandler : public CheckFormatHandler {
8491public:
8492 CheckScanfHandler(Sema &s, const FormatStringLiteral *fexpr,
8493 const Expr *origFormatExpr, FormatStringType type,
8494 unsigned firstDataArg, unsigned numDataArgs,
8495 const char *beg, Sema::FormatArgumentPassingKind APK,
8496 ArrayRef<const Expr *> Args, unsigned formatIdx,
8497 bool inFunctionCall, VariadicCallType CallType,
8498 llvm::SmallBitVector &CheckedVarArgs,
8499 UncoveredArgHandler &UncoveredArg)
8500 : CheckFormatHandler(s, fexpr, origFormatExpr, type, firstDataArg,
8501 numDataArgs, beg, APK, Args, formatIdx,
8502 inFunctionCall, CallType, CheckedVarArgs,
8503 UncoveredArg) {}
8504
8505 bool HandleScanfSpecifier(const analyze_scanf::ScanfSpecifier &FS,
8506 const char *startSpecifier,
8507 unsigned specifierLen) override;
8508
8509 bool HandleInvalidScanfConversionSpecifier(
8510 const analyze_scanf::ScanfSpecifier &FS,
8511 const char *startSpecifier,
8512 unsigned specifierLen) override;
8513
8514 void HandleIncompleteScanList(const char *start, const char *end) override;
8515};
8516
8517} // namespace
8518
8519void CheckScanfHandler::HandleIncompleteScanList(const char *start,
8520 const char *end) {
8521 EmitFormatDiagnostic(S.PDiag(diag::warn_scanf_scanlist_incomplete),
8522 getLocationOfByte(end), /*IsStringLocation*/true,
8523 getSpecifierRange(start, end - start));
8524}
8525
8526bool CheckScanfHandler::HandleInvalidScanfConversionSpecifier(
8527 const analyze_scanf::ScanfSpecifier &FS,
8528 const char *startSpecifier,
8529 unsigned specifierLen) {
8530 const analyze_scanf::ScanfConversionSpecifier &CS =
8531 FS.getConversionSpecifier();
8532
8533 return HandleInvalidConversionSpecifier(argIndex: FS.getArgIndex(),
8534 Loc: getLocationOfByte(x: CS.getStart()),
8535 startSpec: startSpecifier, specifierLen,
8536 csStart: CS.getStart(), csLen: CS.getLength());
8537}
8538
8539bool CheckScanfHandler::HandleScanfSpecifier(
8540 const analyze_scanf::ScanfSpecifier &FS,
8541 const char *startSpecifier,
8542 unsigned specifierLen) {
8543 using namespace analyze_scanf;
8544 using namespace analyze_format_string;
8545
8546 const ScanfConversionSpecifier &CS = FS.getConversionSpecifier();
8547
8548 // Handle case where '%' and '*' don't consume an argument. These shouldn't
8549 // be used to decide if we are using positional arguments consistently.
8550 if (FS.consumesDataArgument()) {
8551 if (atFirstArg) {
8552 atFirstArg = false;
8553 usesPositionalArgs = FS.usesPositionalArg();
8554 }
8555 else if (usesPositionalArgs != FS.usesPositionalArg()) {
8556 HandlePositionalNonpositionalArgs(Loc: getLocationOfByte(x: CS.getStart()),
8557 startSpec: startSpecifier, specifierLen);
8558 return false;
8559 }
8560 }
8561
8562 // Check if the field with is non-zero.
8563 const OptionalAmount &Amt = FS.getFieldWidth();
8564 if (Amt.getHowSpecified() == OptionalAmount::Constant) {
8565 if (Amt.getConstantAmount() == 0) {
8566 const CharSourceRange &R = getSpecifierRange(startSpecifier: Amt.getStart(),
8567 specifierLen: Amt.getConstantLength());
8568 EmitFormatDiagnostic(S.PDiag(diag::warn_scanf_nonzero_width),
8569 getLocationOfByte(Amt.getStart()),
8570 /*IsStringLocation*/true, R,
8571 FixItHint::CreateRemoval(R));
8572 }
8573 }
8574
8575 if (!FS.consumesDataArgument()) {
8576 // FIXME: Technically specifying a precision or field width here
8577 // makes no sense. Worth issuing a warning at some point.
8578 return true;
8579 }
8580
8581 // Consume the argument.
8582 unsigned argIndex = FS.getArgIndex();
8583 if (argIndex < NumDataArgs) {
8584 // The check to see if the argIndex is valid will come later.
8585 // We set the bit here because we may exit early from this
8586 // function if we encounter some other error.
8587 CoveredArgs.set(argIndex);
8588 }
8589
8590 // Check the length modifier is valid with the given conversion specifier.
8591 if (!FS.hasValidLengthModifier(Target: S.getASTContext().getTargetInfo(),
8592 LO: S.getLangOpts()))
8593 HandleInvalidLengthModifier(FS, CS, startSpecifier, specifierLen,
8594 diag::warn_format_nonsensical_length);
8595 else if (!FS.hasStandardLengthModifier())
8596 HandleNonStandardLengthModifier(FS, startSpecifier, specifierLen);
8597 else if (!FS.hasStandardLengthConversionCombination())
8598 HandleInvalidLengthModifier(FS, CS, startSpecifier, specifierLen,
8599 diag::warn_format_non_standard_conversion_spec);
8600
8601 if (!FS.hasStandardConversionSpecifier(LangOpt: S.getLangOpts()))
8602 HandleNonStandardConversionSpecifier(CS, startSpecifier, specifierLen);
8603
8604 // The remaining checks depend on the data arguments.
8605 if (!HasFormatArguments())
8606 return true;
8607
8608 if (!CheckNumArgs(FS, CS, startSpecifier, specifierLen, argIndex))
8609 return false;
8610
8611 // Check that the argument type matches the format specifier.
8612 const Expr *Ex = getDataArg(i: argIndex);
8613 if (!Ex)
8614 return true;
8615
8616 const analyze_format_string::ArgType &AT = FS.getArgType(Ctx&: S.Context);
8617
8618 if (!AT.isValid()) {
8619 return true;
8620 }
8621
8622 analyze_format_string::ArgType::MatchKind Match =
8623 AT.matchesType(C&: S.Context, argTy: Ex->getType());
8624 Match = handleFormatSignedness(Match, Diags&: S.getDiagnostics(), Loc: Ex->getExprLoc());
8625 bool Pedantic = Match == analyze_format_string::ArgType::NoMatchPedantic;
8626 if (Match == analyze_format_string::ArgType::Match)
8627 return true;
8628
8629 ScanfSpecifier fixedFS = FS;
8630 bool Success = fixedFS.fixType(QT: Ex->getType(), RawQT: Ex->IgnoreImpCasts()->getType(),
8631 LangOpt: S.getLangOpts(), Ctx&: S.Context);
8632
8633 unsigned Diag =
8634 Pedantic ? diag::warn_format_conversion_argument_type_mismatch_pedantic
8635 : diag::warn_format_conversion_argument_type_mismatch;
8636
8637 if (Success) {
8638 // Get the fix string from the fixed format specifier.
8639 SmallString<128> buf;
8640 llvm::raw_svector_ostream os(buf);
8641 fixedFS.toString(os);
8642
8643 EmitFormatDiagnostic(
8644 S.PDiag(Diag) << AT.getRepresentativeTypeName(C&: S.Context)
8645 << Ex->getType() << false << Ex->getSourceRange(),
8646 Ex->getBeginLoc(),
8647 /*IsStringLocation*/ false,
8648 getSpecifierRange(startSpecifier, specifierLen),
8649 FixItHint::CreateReplacement(
8650 RemoveRange: getSpecifierRange(startSpecifier, specifierLen), Code: os.str()));
8651 } else {
8652 EmitFormatDiagnostic(S.PDiag(Diag)
8653 << AT.getRepresentativeTypeName(C&: S.Context)
8654 << Ex->getType() << false << Ex->getSourceRange(),
8655 Ex->getBeginLoc(),
8656 /*IsStringLocation*/ false,
8657 getSpecifierRange(startSpecifier, specifierLen));
8658 }
8659
8660 return true;
8661}
8662
8663static bool CompareFormatSpecifiers(Sema &S, const StringLiteral *Ref,
8664 ArrayRef<EquatableFormatArgument> RefArgs,
8665 const StringLiteral *Fmt,
8666 ArrayRef<EquatableFormatArgument> FmtArgs,
8667 const Expr *FmtExpr, bool InFunctionCall) {
8668 bool HadError = false;
8669 auto FmtIter = FmtArgs.begin(), FmtEnd = FmtArgs.end();
8670 auto RefIter = RefArgs.begin(), RefEnd = RefArgs.end();
8671 while (FmtIter < FmtEnd && RefIter < RefEnd) {
8672 // In positional-style format strings, the same specifier can appear
8673 // multiple times (like %2$i %2$d). Specifiers in both RefArgs and FmtArgs
8674 // are sorted by getPosition(), and we process each range of equal
8675 // getPosition() values as one group.
8676 // RefArgs are taken from a string literal that was given to
8677 // attribute(format_matches), and if we got this far, we have already
8678 // verified that if it has positional specifiers that appear in multiple
8679 // locations, then they are all mutually compatible. What's left for us to
8680 // do is verify that all specifiers with the same position in FmtArgs are
8681 // compatible with the RefArgs specifiers. We check each specifier from
8682 // FmtArgs against the first member of the RefArgs group.
8683 for (; FmtIter < FmtEnd; ++FmtIter) {
8684 // Clang does not diagnose missing format specifiers in positional-style
8685 // strings (TODO: which it probably should do, as it is UB to skip over a
8686 // format argument). Skip specifiers if needed.
8687 if (FmtIter->getPosition() < RefIter->getPosition())
8688 continue;
8689
8690 // Delimits a new getPosition() value.
8691 if (FmtIter->getPosition() > RefIter->getPosition())
8692 break;
8693
8694 HadError |=
8695 !FmtIter->VerifyCompatible(S, Other: *RefIter, FmtExpr, InFunctionCall);
8696 }
8697
8698 // Jump RefIter to the start of the next group.
8699 RefIter = std::find_if(first: RefIter + 1, last: RefEnd, pred: [=](const auto &Arg) {
8700 return Arg.getPosition() != RefIter->getPosition();
8701 });
8702 }
8703
8704 if (FmtIter < FmtEnd) {
8705 CheckFormatHandler::EmitFormatDiagnostic(
8706 S, InFunctionCall, FmtExpr,
8707 S.PDiag(diag::warn_format_cmp_specifier_arity) << 1,
8708 FmtExpr->getBeginLoc(), false, FmtIter->getSourceRange());
8709 HadError = S.Diag(Ref->getBeginLoc(), diag::note_format_cmp_with) << 1;
8710 } else if (RefIter < RefEnd) {
8711 CheckFormatHandler::EmitFormatDiagnostic(
8712 S, InFunctionCall, FmtExpr,
8713 S.PDiag(diag::warn_format_cmp_specifier_arity) << 0,
8714 FmtExpr->getBeginLoc(), false, Fmt->getSourceRange());
8715 HadError = S.Diag(Ref->getBeginLoc(), diag::note_format_cmp_with)
8716 << 1 << RefIter->getSourceRange();
8717 }
8718 return !HadError;
8719}
8720
8721static void CheckFormatString(
8722 Sema &S, const FormatStringLiteral *FExpr,
8723 const StringLiteral *ReferenceFormatString, const Expr *OrigFormatExpr,
8724 ArrayRef<const Expr *> Args, Sema::FormatArgumentPassingKind APK,
8725 unsigned format_idx, unsigned firstDataArg, FormatStringType Type,
8726 bool inFunctionCall, VariadicCallType CallType,
8727 llvm::SmallBitVector &CheckedVarArgs, UncoveredArgHandler &UncoveredArg,
8728 bool IgnoreStringsWithoutSpecifiers) {
8729 // CHECK: is the format string a wide literal?
8730 if (!FExpr->isAscii() && !FExpr->isUTF8()) {
8731 CheckFormatHandler::EmitFormatDiagnostic(
8732 S, inFunctionCall, Args[format_idx],
8733 S.PDiag(diag::warn_format_string_is_wide_literal), FExpr->getBeginLoc(),
8734 /*IsStringLocation*/ true, OrigFormatExpr->getSourceRange());
8735 return;
8736 }
8737
8738 // Str - The format string. NOTE: this is NOT null-terminated!
8739 StringRef StrRef = FExpr->getString();
8740 const char *Str = StrRef.data();
8741 // Account for cases where the string literal is truncated in a declaration.
8742 const ConstantArrayType *T =
8743 S.Context.getAsConstantArrayType(T: FExpr->getType());
8744 assert(T && "String literal not of constant array type!");
8745 size_t TypeSize = T->getZExtSize();
8746 size_t StrLen = std::min(a: std::max(a: TypeSize, b: size_t(1)) - 1, b: StrRef.size());
8747 const unsigned numDataArgs = Args.size() - firstDataArg;
8748
8749 if (IgnoreStringsWithoutSpecifiers &&
8750 !analyze_format_string::parseFormatStringHasFormattingSpecifiers(
8751 Begin: Str, End: Str + StrLen, LO: S.getLangOpts(), Target: S.Context.getTargetInfo()))
8752 return;
8753
8754 // Emit a warning if the string literal is truncated and does not contain an
8755 // embedded null character.
8756 if (TypeSize <= StrRef.size() && !StrRef.substr(Start: 0, N: TypeSize).contains(C: '\0')) {
8757 CheckFormatHandler::EmitFormatDiagnostic(
8758 S, inFunctionCall, Args[format_idx],
8759 S.PDiag(diag::warn_printf_format_string_not_null_terminated),
8760 FExpr->getBeginLoc(),
8761 /*IsStringLocation=*/true, OrigFormatExpr->getSourceRange());
8762 return;
8763 }
8764
8765 // CHECK: empty format string?
8766 if (StrLen == 0 && numDataArgs > 0) {
8767 CheckFormatHandler::EmitFormatDiagnostic(
8768 S, inFunctionCall, Args[format_idx],
8769 S.PDiag(diag::warn_empty_format_string), FExpr->getBeginLoc(),
8770 /*IsStringLocation*/ true, OrigFormatExpr->getSourceRange());
8771 return;
8772 }
8773
8774 if (Type == FormatStringType::Printf || Type == FormatStringType::NSString ||
8775 Type == FormatStringType::Kprintf ||
8776 Type == FormatStringType::FreeBSDKPrintf ||
8777 Type == FormatStringType::OSLog || Type == FormatStringType::OSTrace ||
8778 Type == FormatStringType::Syslog) {
8779 bool IsObjC =
8780 Type == FormatStringType::NSString || Type == FormatStringType::OSTrace;
8781 if (ReferenceFormatString == nullptr) {
8782 CheckPrintfHandler H(S, FExpr, OrigFormatExpr, Type, firstDataArg,
8783 numDataArgs, IsObjC, Str, APK, Args, format_idx,
8784 inFunctionCall, CallType, CheckedVarArgs,
8785 UncoveredArg);
8786
8787 if (!analyze_format_string::ParsePrintfString(
8788 H, beg: Str, end: Str + StrLen, LO: S.getLangOpts(), Target: S.Context.getTargetInfo(),
8789 isFreeBSDKPrintf: Type == FormatStringType::Kprintf ||
8790 Type == FormatStringType::FreeBSDKPrintf))
8791 H.DoneProcessing();
8792 } else {
8793 S.CheckFormatStringsCompatible(
8794 FST: Type, AuthoritativeFormatString: ReferenceFormatString, TestedFormatString: FExpr->getFormatString(),
8795 FunctionCallArg: inFunctionCall ? nullptr : Args[format_idx]);
8796 }
8797 } else if (Type == FormatStringType::Scanf) {
8798 CheckScanfHandler H(S, FExpr, OrigFormatExpr, Type, firstDataArg,
8799 numDataArgs, Str, APK, Args, format_idx, inFunctionCall,
8800 CallType, CheckedVarArgs, UncoveredArg);
8801
8802 if (!analyze_format_string::ParseScanfString(
8803 H, beg: Str, end: Str + StrLen, LO: S.getLangOpts(), Target: S.Context.getTargetInfo()))
8804 H.DoneProcessing();
8805 } // TODO: handle other formats
8806}
8807
8808bool Sema::CheckFormatStringsCompatible(
8809 FormatStringType Type, const StringLiteral *AuthoritativeFormatString,
8810 const StringLiteral *TestedFormatString, const Expr *FunctionCallArg) {
8811 if (Type != FormatStringType::Printf && Type != FormatStringType::NSString &&
8812 Type != FormatStringType::Kprintf &&
8813 Type != FormatStringType::FreeBSDKPrintf &&
8814 Type != FormatStringType::OSLog && Type != FormatStringType::OSTrace &&
8815 Type != FormatStringType::Syslog)
8816 return true;
8817
8818 bool IsObjC =
8819 Type == FormatStringType::NSString || Type == FormatStringType::OSTrace;
8820 llvm::SmallVector<EquatableFormatArgument, 9> RefArgs, FmtArgs;
8821 FormatStringLiteral RefLit = AuthoritativeFormatString;
8822 FormatStringLiteral TestLit = TestedFormatString;
8823 const Expr *Arg;
8824 bool DiagAtStringLiteral;
8825 if (FunctionCallArg) {
8826 Arg = FunctionCallArg;
8827 DiagAtStringLiteral = false;
8828 } else {
8829 Arg = TestedFormatString;
8830 DiagAtStringLiteral = true;
8831 }
8832 if (DecomposePrintfHandler::GetSpecifiers(*this, &RefLit,
8833 AuthoritativeFormatString, Type,
8834 IsObjC, true, RefArgs) &&
8835 DecomposePrintfHandler::GetSpecifiers(S&: *this, FSL: &TestLit, FmtExpr: Arg, Type, IsObjC,
8836 InFunctionCall: DiagAtStringLiteral, Args&: FmtArgs)) {
8837 return CompareFormatSpecifiers(S&: *this, Ref: AuthoritativeFormatString, RefArgs,
8838 Fmt: TestedFormatString, FmtArgs, FmtExpr: Arg,
8839 InFunctionCall: DiagAtStringLiteral);
8840 }
8841 return false;
8842}
8843
8844bool Sema::ValidateFormatString(FormatStringType Type,
8845 const StringLiteral *Str) {
8846 if (Type != FormatStringType::Printf && Type != FormatStringType::NSString &&
8847 Type != FormatStringType::Kprintf &&
8848 Type != FormatStringType::FreeBSDKPrintf &&
8849 Type != FormatStringType::OSLog && Type != FormatStringType::OSTrace &&
8850 Type != FormatStringType::Syslog)
8851 return true;
8852
8853 FormatStringLiteral RefLit = Str;
8854 llvm::SmallVector<EquatableFormatArgument, 9> Args;
8855 bool IsObjC =
8856 Type == FormatStringType::NSString || Type == FormatStringType::OSTrace;
8857 if (!DecomposePrintfHandler::GetSpecifiers(*this, &RefLit, Str, Type, IsObjC,
8858 true, Args))
8859 return false;
8860
8861 // Group arguments by getPosition() value, and check that each member of the
8862 // group is compatible with the first member. This verifies that when
8863 // positional arguments are used multiple times (such as %2$i %2$d), all uses
8864 // are mutually compatible. As an optimization, don't test the first member
8865 // against itself.
8866 bool HadError = false;
8867 auto Iter = Args.begin();
8868 auto End = Args.end();
8869 while (Iter != End) {
8870 const auto &FirstInGroup = *Iter;
8871 for (++Iter;
8872 Iter != End && Iter->getPosition() == FirstInGroup.getPosition();
8873 ++Iter) {
8874 HadError |= !Iter->VerifyCompatible(*this, FirstInGroup, Str, true);
8875 }
8876 }
8877 return !HadError;
8878}
8879
8880bool Sema::FormatStringHasSArg(const StringLiteral *FExpr) {
8881 // Str - The format string. NOTE: this is NOT null-terminated!
8882 StringRef StrRef = FExpr->getString();
8883 const char *Str = StrRef.data();
8884 // Account for cases where the string literal is truncated in a declaration.
8885 const ConstantArrayType *T = Context.getAsConstantArrayType(T: FExpr->getType());
8886 assert(T && "String literal not of constant array type!");
8887 size_t TypeSize = T->getZExtSize();
8888 size_t StrLen = std::min(a: std::max(a: TypeSize, b: size_t(1)) - 1, b: StrRef.size());
8889 return analyze_format_string::ParseFormatStringHasSArg(beg: Str, end: Str + StrLen,
8890 LO: getLangOpts(),
8891 Target: Context.getTargetInfo());
8892}
8893
8894//===--- CHECK: Warn on use of wrong absolute value function. -------------===//
8895
8896// Returns the related absolute value function that is larger, of 0 if one
8897// does not exist.
8898static unsigned getLargerAbsoluteValueFunction(unsigned AbsFunction) {
8899 switch (AbsFunction) {
8900 default:
8901 return 0;
8902
8903 case Builtin::BI__builtin_abs:
8904 return Builtin::BI__builtin_labs;
8905 case Builtin::BI__builtin_labs:
8906 return Builtin::BI__builtin_llabs;
8907 case Builtin::BI__builtin_llabs:
8908 return 0;
8909
8910 case Builtin::BI__builtin_fabsf:
8911 return Builtin::BI__builtin_fabs;
8912 case Builtin::BI__builtin_fabs:
8913 return Builtin::BI__builtin_fabsl;
8914 case Builtin::BI__builtin_fabsl:
8915 return 0;
8916
8917 case Builtin::BI__builtin_cabsf:
8918 return Builtin::BI__builtin_cabs;
8919 case Builtin::BI__builtin_cabs:
8920 return Builtin::BI__builtin_cabsl;
8921 case Builtin::BI__builtin_cabsl:
8922 return 0;
8923
8924 case Builtin::BIabs:
8925 return Builtin::BIlabs;
8926 case Builtin::BIlabs:
8927 return Builtin::BIllabs;
8928 case Builtin::BIllabs:
8929 return 0;
8930
8931 case Builtin::BIfabsf:
8932 return Builtin::BIfabs;
8933 case Builtin::BIfabs:
8934 return Builtin::BIfabsl;
8935 case Builtin::BIfabsl:
8936 return 0;
8937
8938 case Builtin::BIcabsf:
8939 return Builtin::BIcabs;
8940 case Builtin::BIcabs:
8941 return Builtin::BIcabsl;
8942 case Builtin::BIcabsl:
8943 return 0;
8944 }
8945}
8946
8947// Returns the argument type of the absolute value function.
8948static QualType getAbsoluteValueArgumentType(ASTContext &Context,
8949 unsigned AbsType) {
8950 if (AbsType == 0)
8951 return QualType();
8952
8953 ASTContext::GetBuiltinTypeError Error = ASTContext::GE_None;
8954 QualType BuiltinType = Context.GetBuiltinType(ID: AbsType, Error);
8955 if (Error != ASTContext::GE_None)
8956 return QualType();
8957
8958 const FunctionProtoType *FT = BuiltinType->getAs<FunctionProtoType>();
8959 if (!FT)
8960 return QualType();
8961
8962 if (FT->getNumParams() != 1)
8963 return QualType();
8964
8965 return FT->getParamType(i: 0);
8966}
8967
8968// Returns the best absolute value function, or zero, based on type and
8969// current absolute value function.
8970static unsigned getBestAbsFunction(ASTContext &Context, QualType ArgType,
8971 unsigned AbsFunctionKind) {
8972 unsigned BestKind = 0;
8973 uint64_t ArgSize = Context.getTypeSize(T: ArgType);
8974 for (unsigned Kind = AbsFunctionKind; Kind != 0;
8975 Kind = getLargerAbsoluteValueFunction(AbsFunction: Kind)) {
8976 QualType ParamType = getAbsoluteValueArgumentType(Context, AbsType: Kind);
8977 if (Context.getTypeSize(T: ParamType) >= ArgSize) {
8978 if (BestKind == 0)
8979 BestKind = Kind;
8980 else if (Context.hasSameType(T1: ParamType, T2: ArgType)) {
8981 BestKind = Kind;
8982 break;
8983 }
8984 }
8985 }
8986 return BestKind;
8987}
8988
8989enum AbsoluteValueKind {
8990 AVK_Integer,
8991 AVK_Floating,
8992 AVK_Complex
8993};
8994
8995static AbsoluteValueKind getAbsoluteValueKind(QualType T) {
8996 if (T->isIntegralOrEnumerationType())
8997 return AVK_Integer;
8998 if (T->isRealFloatingType())
8999 return AVK_Floating;
9000 if (T->isAnyComplexType())
9001 return AVK_Complex;
9002
9003 llvm_unreachable("Type not integer, floating, or complex");
9004}
9005
9006// Changes the absolute value function to a different type. Preserves whether
9007// the function is a builtin.
9008static unsigned changeAbsFunction(unsigned AbsKind,
9009 AbsoluteValueKind ValueKind) {
9010 switch (ValueKind) {
9011 case AVK_Integer:
9012 switch (AbsKind) {
9013 default:
9014 return 0;
9015 case Builtin::BI__builtin_fabsf:
9016 case Builtin::BI__builtin_fabs:
9017 case Builtin::BI__builtin_fabsl:
9018 case Builtin::BI__builtin_cabsf:
9019 case Builtin::BI__builtin_cabs:
9020 case Builtin::BI__builtin_cabsl:
9021 return Builtin::BI__builtin_abs;
9022 case Builtin::BIfabsf:
9023 case Builtin::BIfabs:
9024 case Builtin::BIfabsl:
9025 case Builtin::BIcabsf:
9026 case Builtin::BIcabs:
9027 case Builtin::BIcabsl:
9028 return Builtin::BIabs;
9029 }
9030 case AVK_Floating:
9031 switch (AbsKind) {
9032 default:
9033 return 0;
9034 case Builtin::BI__builtin_abs:
9035 case Builtin::BI__builtin_labs:
9036 case Builtin::BI__builtin_llabs:
9037 case Builtin::BI__builtin_cabsf:
9038 case Builtin::BI__builtin_cabs:
9039 case Builtin::BI__builtin_cabsl:
9040 return Builtin::BI__builtin_fabsf;
9041 case Builtin::BIabs:
9042 case Builtin::BIlabs:
9043 case Builtin::BIllabs:
9044 case Builtin::BIcabsf:
9045 case Builtin::BIcabs:
9046 case Builtin::BIcabsl:
9047 return Builtin::BIfabsf;
9048 }
9049 case AVK_Complex:
9050 switch (AbsKind) {
9051 default:
9052 return 0;
9053 case Builtin::BI__builtin_abs:
9054 case Builtin::BI__builtin_labs:
9055 case Builtin::BI__builtin_llabs:
9056 case Builtin::BI__builtin_fabsf:
9057 case Builtin::BI__builtin_fabs:
9058 case Builtin::BI__builtin_fabsl:
9059 return Builtin::BI__builtin_cabsf;
9060 case Builtin::BIabs:
9061 case Builtin::BIlabs:
9062 case Builtin::BIllabs:
9063 case Builtin::BIfabsf:
9064 case Builtin::BIfabs:
9065 case Builtin::BIfabsl:
9066 return Builtin::BIcabsf;
9067 }
9068 }
9069 llvm_unreachable("Unable to convert function");
9070}
9071
9072static unsigned getAbsoluteValueFunctionKind(const FunctionDecl *FDecl) {
9073 const IdentifierInfo *FnInfo = FDecl->getIdentifier();
9074 if (!FnInfo)
9075 return 0;
9076
9077 switch (FDecl->getBuiltinID()) {
9078 default:
9079 return 0;
9080 case Builtin::BI__builtin_abs:
9081 case Builtin::BI__builtin_fabs:
9082 case Builtin::BI__builtin_fabsf:
9083 case Builtin::BI__builtin_fabsl:
9084 case Builtin::BI__builtin_labs:
9085 case Builtin::BI__builtin_llabs:
9086 case Builtin::BI__builtin_cabs:
9087 case Builtin::BI__builtin_cabsf:
9088 case Builtin::BI__builtin_cabsl:
9089 case Builtin::BIabs:
9090 case Builtin::BIlabs:
9091 case Builtin::BIllabs:
9092 case Builtin::BIfabs:
9093 case Builtin::BIfabsf:
9094 case Builtin::BIfabsl:
9095 case Builtin::BIcabs:
9096 case Builtin::BIcabsf:
9097 case Builtin::BIcabsl:
9098 return FDecl->getBuiltinID();
9099 }
9100 llvm_unreachable("Unknown Builtin type");
9101}
9102
9103// If the replacement is valid, emit a note with replacement function.
9104// Additionally, suggest including the proper header if not already included.
9105static void emitReplacement(Sema &S, SourceLocation Loc, SourceRange Range,
9106 unsigned AbsKind, QualType ArgType) {
9107 bool EmitHeaderHint = true;
9108 const char *HeaderName = nullptr;
9109 std::string FunctionName;
9110 if (S.getLangOpts().CPlusPlus && !ArgType->isAnyComplexType()) {
9111 FunctionName = "std::abs";
9112 if (ArgType->isIntegralOrEnumerationType()) {
9113 HeaderName = "cstdlib";
9114 } else if (ArgType->isRealFloatingType()) {
9115 HeaderName = "cmath";
9116 } else {
9117 llvm_unreachable("Invalid Type");
9118 }
9119
9120 // Lookup all std::abs
9121 if (NamespaceDecl *Std = S.getStdNamespace()) {
9122 LookupResult R(S, &S.Context.Idents.get(Name: "abs"), Loc, Sema::LookupAnyName);
9123 R.suppressDiagnostics();
9124 S.LookupQualifiedName(R, Std);
9125
9126 for (const auto *I : R) {
9127 const FunctionDecl *FDecl = nullptr;
9128 if (const UsingShadowDecl *UsingD = dyn_cast<UsingShadowDecl>(Val: I)) {
9129 FDecl = dyn_cast<FunctionDecl>(Val: UsingD->getTargetDecl());
9130 } else {
9131 FDecl = dyn_cast<FunctionDecl>(Val: I);
9132 }
9133 if (!FDecl)
9134 continue;
9135
9136 // Found std::abs(), check that they are the right ones.
9137 if (FDecl->getNumParams() != 1)
9138 continue;
9139
9140 // Check that the parameter type can handle the argument.
9141 QualType ParamType = FDecl->getParamDecl(i: 0)->getType();
9142 if (getAbsoluteValueKind(T: ArgType) == getAbsoluteValueKind(T: ParamType) &&
9143 S.Context.getTypeSize(T: ArgType) <=
9144 S.Context.getTypeSize(T: ParamType)) {
9145 // Found a function, don't need the header hint.
9146 EmitHeaderHint = false;
9147 break;
9148 }
9149 }
9150 }
9151 } else {
9152 FunctionName = S.Context.BuiltinInfo.getName(ID: AbsKind);
9153 HeaderName = S.Context.BuiltinInfo.getHeaderName(ID: AbsKind);
9154
9155 if (HeaderName) {
9156 DeclarationName DN(&S.Context.Idents.get(Name: FunctionName));
9157 LookupResult R(S, DN, Loc, Sema::LookupAnyName);
9158 R.suppressDiagnostics();
9159 S.LookupName(R, S: S.getCurScope());
9160
9161 if (R.isSingleResult()) {
9162 FunctionDecl *FD = dyn_cast<FunctionDecl>(Val: R.getFoundDecl());
9163 if (FD && FD->getBuiltinID() == AbsKind) {
9164 EmitHeaderHint = false;
9165 } else {
9166 return;
9167 }
9168 } else if (!R.empty()) {
9169 return;
9170 }
9171 }
9172 }
9173
9174 S.Diag(Loc, diag::note_replace_abs_function)
9175 << FunctionName << FixItHint::CreateReplacement(Range, FunctionName);
9176
9177 if (!HeaderName)
9178 return;
9179
9180 if (!EmitHeaderHint)
9181 return;
9182
9183 S.Diag(Loc, diag::note_include_header_or_declare) << HeaderName
9184 << FunctionName;
9185}
9186
9187template <std::size_t StrLen>
9188static bool IsStdFunction(const FunctionDecl *FDecl,
9189 const char (&Str)[StrLen]) {
9190 if (!FDecl)
9191 return false;
9192 if (!FDecl->getIdentifier() || !FDecl->getIdentifier()->isStr(Str))
9193 return false;
9194 if (!FDecl->isInStdNamespace())
9195 return false;
9196
9197 return true;
9198}
9199
9200enum class MathCheck { NaN, Inf };
9201static bool IsInfOrNanFunction(StringRef calleeName, MathCheck Check) {
9202 auto MatchesAny = [&](std::initializer_list<llvm::StringRef> names) {
9203 return llvm::is_contained(Set: names, Element: calleeName);
9204 };
9205
9206 switch (Check) {
9207 case MathCheck::NaN:
9208 return MatchesAny({"__builtin_nan", "__builtin_nanf", "__builtin_nanl",
9209 "__builtin_nanf16", "__builtin_nanf128"});
9210 case MathCheck::Inf:
9211 return MatchesAny({"__builtin_inf", "__builtin_inff", "__builtin_infl",
9212 "__builtin_inff16", "__builtin_inff128"});
9213 }
9214 llvm_unreachable("unknown MathCheck");
9215}
9216
9217static bool IsInfinityFunction(const FunctionDecl *FDecl) {
9218 if (FDecl->getName() != "infinity")
9219 return false;
9220
9221 if (const CXXMethodDecl *MDecl = dyn_cast<CXXMethodDecl>(Val: FDecl)) {
9222 const CXXRecordDecl *RDecl = MDecl->getParent();
9223 if (RDecl->getName() != "numeric_limits")
9224 return false;
9225
9226 if (const NamespaceDecl *NSDecl =
9227 dyn_cast<NamespaceDecl>(RDecl->getDeclContext()))
9228 return NSDecl->isStdNamespace();
9229 }
9230
9231 return false;
9232}
9233
9234void Sema::CheckInfNaNFunction(const CallExpr *Call,
9235 const FunctionDecl *FDecl) {
9236 if (!FDecl->getIdentifier())
9237 return;
9238
9239 FPOptions FPO = Call->getFPFeaturesInEffect(LO: getLangOpts());
9240 if (FPO.getNoHonorNaNs() &&
9241 (IsStdFunction(FDecl, Str: "isnan") || IsStdFunction(FDecl, Str: "isunordered") ||
9242 IsInfOrNanFunction(FDecl->getName(), MathCheck::NaN))) {
9243 Diag(Call->getBeginLoc(), diag::warn_fp_nan_inf_when_disabled)
9244 << 1 << 0 << Call->getSourceRange();
9245 return;
9246 }
9247
9248 if (FPO.getNoHonorInfs() &&
9249 (IsStdFunction(FDecl, Str: "isinf") || IsStdFunction(FDecl, Str: "isfinite") ||
9250 IsInfinityFunction(FDecl) ||
9251 IsInfOrNanFunction(FDecl->getName(), MathCheck::Inf))) {
9252 Diag(Call->getBeginLoc(), diag::warn_fp_nan_inf_when_disabled)
9253 << 0 << 0 << Call->getSourceRange();
9254 }
9255}
9256
9257void Sema::CheckAbsoluteValueFunction(const CallExpr *Call,
9258 const FunctionDecl *FDecl) {
9259 if (Call->getNumArgs() != 1)
9260 return;
9261
9262 unsigned AbsKind = getAbsoluteValueFunctionKind(FDecl);
9263 bool IsStdAbs = IsStdFunction(FDecl, Str: "abs");
9264 if (AbsKind == 0 && !IsStdAbs)
9265 return;
9266
9267 QualType ArgType = Call->getArg(Arg: 0)->IgnoreParenImpCasts()->getType();
9268 QualType ParamType = Call->getArg(Arg: 0)->getType();
9269
9270 // Unsigned types cannot be negative. Suggest removing the absolute value
9271 // function call.
9272 if (ArgType->isUnsignedIntegerType()) {
9273 std::string FunctionName =
9274 IsStdAbs ? "std::abs" : Context.BuiltinInfo.getName(ID: AbsKind);
9275 Diag(Call->getExprLoc(), diag::warn_unsigned_abs) << ArgType << ParamType;
9276 Diag(Call->getExprLoc(), diag::note_remove_abs)
9277 << FunctionName
9278 << FixItHint::CreateRemoval(Call->getCallee()->getSourceRange());
9279 return;
9280 }
9281
9282 // Taking the absolute value of a pointer is very suspicious, they probably
9283 // wanted to index into an array, dereference a pointer, call a function, etc.
9284 if (ArgType->isPointerType() || ArgType->canDecayToPointerType()) {
9285 unsigned DiagType = 0;
9286 if (ArgType->isFunctionType())
9287 DiagType = 1;
9288 else if (ArgType->isArrayType())
9289 DiagType = 2;
9290
9291 Diag(Call->getExprLoc(), diag::warn_pointer_abs) << DiagType << ArgType;
9292 return;
9293 }
9294
9295 // std::abs has overloads which prevent most of the absolute value problems
9296 // from occurring.
9297 if (IsStdAbs)
9298 return;
9299
9300 AbsoluteValueKind ArgValueKind = getAbsoluteValueKind(T: ArgType);
9301 AbsoluteValueKind ParamValueKind = getAbsoluteValueKind(T: ParamType);
9302
9303 // The argument and parameter are the same kind. Check if they are the right
9304 // size.
9305 if (ArgValueKind == ParamValueKind) {
9306 if (Context.getTypeSize(T: ArgType) <= Context.getTypeSize(T: ParamType))
9307 return;
9308
9309 unsigned NewAbsKind = getBestAbsFunction(Context, ArgType, AbsFunctionKind: AbsKind);
9310 Diag(Call->getExprLoc(), diag::warn_abs_too_small)
9311 << FDecl << ArgType << ParamType;
9312
9313 if (NewAbsKind == 0)
9314 return;
9315
9316 emitReplacement(*this, Call->getExprLoc(),
9317 Call->getCallee()->getSourceRange(), NewAbsKind, ArgType);
9318 return;
9319 }
9320
9321 // ArgValueKind != ParamValueKind
9322 // The wrong type of absolute value function was used. Attempt to find the
9323 // proper one.
9324 unsigned NewAbsKind = changeAbsFunction(AbsKind, ValueKind: ArgValueKind);
9325 NewAbsKind = getBestAbsFunction(Context, ArgType, AbsFunctionKind: NewAbsKind);
9326 if (NewAbsKind == 0)
9327 return;
9328
9329 Diag(Call->getExprLoc(), diag::warn_wrong_absolute_value_type)
9330 << FDecl << ParamValueKind << ArgValueKind;
9331
9332 emitReplacement(*this, Call->getExprLoc(),
9333 Call->getCallee()->getSourceRange(), NewAbsKind, ArgType);
9334}
9335
9336//===--- CHECK: Warn on use of std::max and unsigned zero. r---------------===//
9337void Sema::CheckMaxUnsignedZero(const CallExpr *Call,
9338 const FunctionDecl *FDecl) {
9339 if (!Call || !FDecl) return;
9340
9341 // Ignore template specializations and macros.
9342 if (inTemplateInstantiation()) return;
9343 if (Call->getExprLoc().isMacroID()) return;
9344
9345 // Only care about the one template argument, two function parameter std::max
9346 if (Call->getNumArgs() != 2) return;
9347 if (!IsStdFunction(FDecl, Str: "max")) return;
9348 const auto * ArgList = FDecl->getTemplateSpecializationArgs();
9349 if (!ArgList) return;
9350 if (ArgList->size() != 1) return;
9351
9352 // Check that template type argument is unsigned integer.
9353 const auto& TA = ArgList->get(Idx: 0);
9354 if (TA.getKind() != TemplateArgument::Type) return;
9355 QualType ArgType = TA.getAsType();
9356 if (!ArgType->isUnsignedIntegerType()) return;
9357
9358 // See if either argument is a literal zero.
9359 auto IsLiteralZeroArg = [](const Expr* E) -> bool {
9360 const auto *MTE = dyn_cast<MaterializeTemporaryExpr>(Val: E);
9361 if (!MTE) return false;
9362 const auto *Num = dyn_cast<IntegerLiteral>(Val: MTE->getSubExpr());
9363 if (!Num) return false;
9364 if (Num->getValue() != 0) return false;
9365 return true;
9366 };
9367
9368 const Expr *FirstArg = Call->getArg(Arg: 0);
9369 const Expr *SecondArg = Call->getArg(Arg: 1);
9370 const bool IsFirstArgZero = IsLiteralZeroArg(FirstArg);
9371 const bool IsSecondArgZero = IsLiteralZeroArg(SecondArg);
9372
9373 // Only warn when exactly one argument is zero.
9374 if (IsFirstArgZero == IsSecondArgZero) return;
9375
9376 SourceRange FirstRange = FirstArg->getSourceRange();
9377 SourceRange SecondRange = SecondArg->getSourceRange();
9378
9379 SourceRange ZeroRange = IsFirstArgZero ? FirstRange : SecondRange;
9380
9381 Diag(Call->getExprLoc(), diag::warn_max_unsigned_zero)
9382 << IsFirstArgZero << Call->getCallee()->getSourceRange() << ZeroRange;
9383
9384 // Deduce what parts to remove so that "std::max(0u, foo)" becomes "(foo)".
9385 SourceRange RemovalRange;
9386 if (IsFirstArgZero) {
9387 RemovalRange = SourceRange(FirstRange.getBegin(),
9388 SecondRange.getBegin().getLocWithOffset(Offset: -1));
9389 } else {
9390 RemovalRange = SourceRange(getLocForEndOfToken(Loc: FirstRange.getEnd()),
9391 SecondRange.getEnd());
9392 }
9393
9394 Diag(Call->getExprLoc(), diag::note_remove_max_call)
9395 << FixItHint::CreateRemoval(Call->getCallee()->getSourceRange())
9396 << FixItHint::CreateRemoval(RemovalRange);
9397}
9398
9399//===--- CHECK: Standard memory functions ---------------------------------===//
9400
9401/// Takes the expression passed to the size_t parameter of functions
9402/// such as memcmp, strncat, etc and warns if it's a comparison.
9403///
9404/// This is to catch typos like `if (memcmp(&a, &b, sizeof(a) > 0))`.
9405static bool CheckMemorySizeofForComparison(Sema &S, const Expr *E,
9406 const IdentifierInfo *FnName,
9407 SourceLocation FnLoc,
9408 SourceLocation RParenLoc) {
9409 const auto *Size = dyn_cast<BinaryOperator>(Val: E);
9410 if (!Size)
9411 return false;
9412
9413 // if E is binop and op is <=>, >, <, >=, <=, ==, &&, ||:
9414 if (!Size->isComparisonOp() && !Size->isLogicalOp())
9415 return false;
9416
9417 SourceRange SizeRange = Size->getSourceRange();
9418 S.Diag(Size->getOperatorLoc(), diag::warn_memsize_comparison)
9419 << SizeRange << FnName;
9420 S.Diag(FnLoc, diag::note_memsize_comparison_paren)
9421 << FnName
9422 << FixItHint::CreateInsertion(
9423 S.getLocForEndOfToken(Size->getLHS()->getEndLoc()), ")")
9424 << FixItHint::CreateRemoval(RParenLoc);
9425 S.Diag(SizeRange.getBegin(), diag::note_memsize_comparison_cast_silence)
9426 << FixItHint::CreateInsertion(SizeRange.getBegin(), "(size_t)(")
9427 << FixItHint::CreateInsertion(S.getLocForEndOfToken(SizeRange.getEnd()),
9428 ")");
9429
9430 return true;
9431}
9432
9433/// Determine whether the given type is or contains a dynamic class type
9434/// (e.g., whether it has a vtable).
9435static const CXXRecordDecl *getContainedDynamicClass(QualType T,
9436 bool &IsContained) {
9437 // Look through array types while ignoring qualifiers.
9438 const Type *Ty = T->getBaseElementTypeUnsafe();
9439 IsContained = false;
9440
9441 const CXXRecordDecl *RD = Ty->getAsCXXRecordDecl();
9442 RD = RD ? RD->getDefinition() : nullptr;
9443 if (!RD || RD->isInvalidDecl())
9444 return nullptr;
9445
9446 if (RD->isDynamicClass())
9447 return RD;
9448
9449 // Check all the fields. If any bases were dynamic, the class is dynamic.
9450 // It's impossible for a class to transitively contain itself by value, so
9451 // infinite recursion is impossible.
9452 for (auto *FD : RD->fields()) {
9453 bool SubContained;
9454 if (const CXXRecordDecl *ContainedRD =
9455 getContainedDynamicClass(FD->getType(), SubContained)) {
9456 IsContained = true;
9457 return ContainedRD;
9458 }
9459 }
9460
9461 return nullptr;
9462}
9463
9464static const UnaryExprOrTypeTraitExpr *getAsSizeOfExpr(const Expr *E) {
9465 if (const auto *Unary = dyn_cast<UnaryExprOrTypeTraitExpr>(Val: E))
9466 if (Unary->getKind() == UETT_SizeOf)
9467 return Unary;
9468 return nullptr;
9469}
9470
9471/// If E is a sizeof expression, returns its argument expression,
9472/// otherwise returns NULL.
9473static const Expr *getSizeOfExprArg(const Expr *E) {
9474 if (const UnaryExprOrTypeTraitExpr *SizeOf = getAsSizeOfExpr(E))
9475 if (!SizeOf->isArgumentType())
9476 return SizeOf->getArgumentExpr()->IgnoreParenImpCasts();
9477 return nullptr;
9478}
9479
9480/// If E is a sizeof expression, returns its argument type.
9481static QualType getSizeOfArgType(const Expr *E) {
9482 if (const UnaryExprOrTypeTraitExpr *SizeOf = getAsSizeOfExpr(E))
9483 return SizeOf->getTypeOfArgument();
9484 return QualType();
9485}
9486
9487namespace {
9488
9489struct SearchNonTrivialToInitializeField
9490 : DefaultInitializedTypeVisitor<SearchNonTrivialToInitializeField> {
9491 using Super =
9492 DefaultInitializedTypeVisitor<SearchNonTrivialToInitializeField>;
9493
9494 SearchNonTrivialToInitializeField(const Expr *E, Sema &S) : E(E), S(S) {}
9495
9496 void visitWithKind(QualType::PrimitiveDefaultInitializeKind PDIK, QualType FT,
9497 SourceLocation SL) {
9498 if (const auto *AT = asDerived().getContext().getAsArrayType(T: FT)) {
9499 asDerived().visitArray(PDIK, AT, SL);
9500 return;
9501 }
9502
9503 Super::visitWithKind(PDIK, FT, Args&: SL);
9504 }
9505
9506 void visitARCStrong(QualType FT, SourceLocation SL) {
9507 S.DiagRuntimeBehavior(SL, E, S.PDiag(diag::note_nontrivial_field) << 1);
9508 }
9509 void visitARCWeak(QualType FT, SourceLocation SL) {
9510 S.DiagRuntimeBehavior(SL, E, S.PDiag(diag::note_nontrivial_field) << 1);
9511 }
9512 void visitStruct(QualType FT, SourceLocation SL) {
9513 for (const FieldDecl *FD : FT->castAs<RecordType>()->getDecl()->fields())
9514 visit(FD->getType(), FD->getLocation());
9515 }
9516 void visitArray(QualType::PrimitiveDefaultInitializeKind PDIK,
9517 const ArrayType *AT, SourceLocation SL) {
9518 visit(FT: getContext().getBaseElementType(VAT: AT), Args&: SL);
9519 }
9520 void visitTrivial(QualType FT, SourceLocation SL) {}
9521
9522 static void diag(QualType RT, const Expr *E, Sema &S) {
9523 SearchNonTrivialToInitializeField(E, S).visitStruct(FT: RT, SL: SourceLocation());
9524 }
9525
9526 ASTContext &getContext() { return S.getASTContext(); }
9527
9528 const Expr *E;
9529 Sema &S;
9530};
9531
9532struct SearchNonTrivialToCopyField
9533 : CopiedTypeVisitor<SearchNonTrivialToCopyField, false> {
9534 using Super = CopiedTypeVisitor<SearchNonTrivialToCopyField, false>;
9535
9536 SearchNonTrivialToCopyField(const Expr *E, Sema &S) : E(E), S(S) {}
9537
9538 void visitWithKind(QualType::PrimitiveCopyKind PCK, QualType FT,
9539 SourceLocation SL) {
9540 if (const auto *AT = asDerived().getContext().getAsArrayType(T: FT)) {
9541 asDerived().visitArray(PCK, AT, SL);
9542 return;
9543 }
9544
9545 Super::visitWithKind(PCK, FT, Args&: SL);
9546 }
9547
9548 void visitARCStrong(QualType FT, SourceLocation SL) {
9549 S.DiagRuntimeBehavior(SL, E, S.PDiag(diag::note_nontrivial_field) << 0);
9550 }
9551 void visitARCWeak(QualType FT, SourceLocation SL) {
9552 S.DiagRuntimeBehavior(SL, E, S.PDiag(diag::note_nontrivial_field) << 0);
9553 }
9554 void visitPtrAuth(QualType FT, SourceLocation SL) {
9555 S.DiagRuntimeBehavior(SL, E, S.PDiag(diag::note_nontrivial_field) << 0);
9556 }
9557 void visitStruct(QualType FT, SourceLocation SL) {
9558 for (const FieldDecl *FD : FT->castAs<RecordType>()->getDecl()->fields())
9559 visit(FD->getType(), FD->getLocation());
9560 }
9561 void visitArray(QualType::PrimitiveCopyKind PCK, const ArrayType *AT,
9562 SourceLocation SL) {
9563 visit(FT: getContext().getBaseElementType(VAT: AT), Args&: SL);
9564 }
9565 void preVisit(QualType::PrimitiveCopyKind PCK, QualType FT,
9566 SourceLocation SL) {}
9567 void visitTrivial(QualType FT, SourceLocation SL) {}
9568 void visitVolatileTrivial(QualType FT, SourceLocation SL) {}
9569
9570 static void diag(QualType RT, const Expr *E, Sema &S) {
9571 SearchNonTrivialToCopyField(E, S).visitStruct(FT: RT, SL: SourceLocation());
9572 }
9573
9574 ASTContext &getContext() { return S.getASTContext(); }
9575
9576 const Expr *E;
9577 Sema &S;
9578};
9579
9580}
9581
9582/// Detect if \c SizeofExpr is likely to calculate the sizeof an object.
9583static bool doesExprLikelyComputeSize(const Expr *SizeofExpr) {
9584 SizeofExpr = SizeofExpr->IgnoreParenImpCasts();
9585
9586 if (const auto *BO = dyn_cast<BinaryOperator>(Val: SizeofExpr)) {
9587 if (BO->getOpcode() != BO_Mul && BO->getOpcode() != BO_Add)
9588 return false;
9589
9590 return doesExprLikelyComputeSize(SizeofExpr: BO->getLHS()) ||
9591 doesExprLikelyComputeSize(SizeofExpr: BO->getRHS());
9592 }
9593
9594 return getAsSizeOfExpr(E: SizeofExpr) != nullptr;
9595}
9596
9597/// Check if the ArgLoc originated from a macro passed to the call at CallLoc.
9598///
9599/// \code
9600/// #define MACRO 0
9601/// foo(MACRO);
9602/// foo(0);
9603/// \endcode
9604///
9605/// This should return true for the first call to foo, but not for the second
9606/// (regardless of whether foo is a macro or function).
9607static bool isArgumentExpandedFromMacro(SourceManager &SM,
9608 SourceLocation CallLoc,
9609 SourceLocation ArgLoc) {
9610 if (!CallLoc.isMacroID())
9611 return SM.getFileID(SpellingLoc: CallLoc) != SM.getFileID(SpellingLoc: ArgLoc);
9612
9613 return SM.getFileID(SpellingLoc: SM.getImmediateMacroCallerLoc(Loc: CallLoc)) !=
9614 SM.getFileID(SpellingLoc: SM.getImmediateMacroCallerLoc(Loc: ArgLoc));
9615}
9616
9617/// Diagnose cases like 'memset(buf, sizeof(buf), 0)', which should have the
9618/// last two arguments transposed.
9619static void CheckMemaccessSize(Sema &S, unsigned BId, const CallExpr *Call) {
9620 if (BId != Builtin::BImemset && BId != Builtin::BIbzero)
9621 return;
9622
9623 const Expr *SizeArg =
9624 Call->getArg(BId == Builtin::BImemset ? 2 : 1)->IgnoreImpCasts();
9625
9626 auto isLiteralZero = [](const Expr *E) {
9627 return (isa<IntegerLiteral>(E) &&
9628 cast<IntegerLiteral>(E)->getValue() == 0) ||
9629 (isa<CharacterLiteral>(E) &&
9630 cast<CharacterLiteral>(E)->getValue() == 0);
9631 };
9632
9633 // If we're memsetting or bzeroing 0 bytes, then this is likely an error.
9634 SourceLocation CallLoc = Call->getRParenLoc();
9635 SourceManager &SM = S.getSourceManager();
9636 if (isLiteralZero(SizeArg) &&
9637 !isArgumentExpandedFromMacro(SM, CallLoc, ArgLoc: SizeArg->getExprLoc())) {
9638
9639 SourceLocation DiagLoc = SizeArg->getExprLoc();
9640
9641 // Some platforms #define bzero to __builtin_memset. See if this is the
9642 // case, and if so, emit a better diagnostic.
9643 if (BId == Builtin::BIbzero ||
9644 (CallLoc.isMacroID() && Lexer::getImmediateMacroName(
9645 CallLoc, SM, S.getLangOpts()) == "bzero")) {
9646 S.Diag(DiagLoc, diag::warn_suspicious_bzero_size);
9647 S.Diag(DiagLoc, diag::note_suspicious_bzero_size_silence);
9648 } else if (!isLiteralZero(Call->getArg(Arg: 1)->IgnoreImpCasts())) {
9649 S.Diag(DiagLoc, diag::warn_suspicious_sizeof_memset) << 0;
9650 S.Diag(DiagLoc, diag::note_suspicious_sizeof_memset_silence) << 0;
9651 }
9652 return;
9653 }
9654
9655 // If the second argument to a memset is a sizeof expression and the third
9656 // isn't, this is also likely an error. This should catch
9657 // 'memset(buf, sizeof(buf), 0xff)'.
9658 if (BId == Builtin::BImemset &&
9659 doesExprLikelyComputeSize(Call->getArg(1)) &&
9660 !doesExprLikelyComputeSize(Call->getArg(2))) {
9661 SourceLocation DiagLoc = Call->getArg(Arg: 1)->getExprLoc();
9662 S.Diag(DiagLoc, diag::warn_suspicious_sizeof_memset) << 1;
9663 S.Diag(DiagLoc, diag::note_suspicious_sizeof_memset_silence) << 1;
9664 return;
9665 }
9666}
9667
9668void Sema::CheckMemaccessArguments(const CallExpr *Call,
9669 unsigned BId,
9670 IdentifierInfo *FnName) {
9671 assert(BId != 0);
9672
9673 // It is possible to have a non-standard definition of memset. Validate
9674 // we have enough arguments, and if not, abort further checking.
9675 unsigned ExpectedNumArgs =
9676 (BId == Builtin::BIstrndup || BId == Builtin::BIbzero ? 2 : 3);
9677 if (Call->getNumArgs() < ExpectedNumArgs)
9678 return;
9679
9680 unsigned LastArg = (BId == Builtin::BImemset || BId == Builtin::BIbzero ||
9681 BId == Builtin::BIstrndup ? 1 : 2);
9682 unsigned LenArg =
9683 (BId == Builtin::BIbzero || BId == Builtin::BIstrndup ? 1 : 2);
9684 const Expr *LenExpr = Call->getArg(Arg: LenArg)->IgnoreParenImpCasts();
9685
9686 if (CheckMemorySizeofForComparison(S&: *this, E: LenExpr, FnName,
9687 FnLoc: Call->getBeginLoc(), RParenLoc: Call->getRParenLoc()))
9688 return;
9689
9690 // Catch cases like 'memset(buf, sizeof(buf), 0)'.
9691 CheckMemaccessSize(S&: *this, BId, Call);
9692
9693 // We have special checking when the length is a sizeof expression.
9694 QualType SizeOfArgTy = getSizeOfArgType(E: LenExpr);
9695 const Expr *SizeOfArg = getSizeOfExprArg(E: LenExpr);
9696 llvm::FoldingSetNodeID SizeOfArgID;
9697
9698 // Although widely used, 'bzero' is not a standard function. Be more strict
9699 // with the argument types before allowing diagnostics and only allow the
9700 // form bzero(ptr, sizeof(...)).
9701 QualType FirstArgTy = Call->getArg(Arg: 0)->IgnoreParenImpCasts()->getType();
9702 if (BId == Builtin::BIbzero && !FirstArgTy->getAs<PointerType>())
9703 return;
9704
9705 for (unsigned ArgIdx = 0; ArgIdx != LastArg; ++ArgIdx) {
9706 const Expr *Dest = Call->getArg(Arg: ArgIdx)->IgnoreParenImpCasts();
9707 SourceRange ArgRange = Call->getArg(Arg: ArgIdx)->getSourceRange();
9708
9709 QualType DestTy = Dest->getType();
9710 QualType PointeeTy;
9711 if (const PointerType *DestPtrTy = DestTy->getAs<PointerType>()) {
9712 PointeeTy = DestPtrTy->getPointeeType();
9713
9714 // Never warn about void type pointers. This can be used to suppress
9715 // false positives.
9716 if (PointeeTy->isVoidType())
9717 continue;
9718
9719 // Catch "memset(p, 0, sizeof(p))" -- needs to be sizeof(*p). Do this by
9720 // actually comparing the expressions for equality. Because computing the
9721 // expression IDs can be expensive, we only do this if the diagnostic is
9722 // enabled.
9723 if (SizeOfArg &&
9724 !Diags.isIgnored(diag::warn_sizeof_pointer_expr_memaccess,
9725 SizeOfArg->getExprLoc())) {
9726 // We only compute IDs for expressions if the warning is enabled, and
9727 // cache the sizeof arg's ID.
9728 if (SizeOfArgID == llvm::FoldingSetNodeID())
9729 SizeOfArg->Profile(SizeOfArgID, Context, true);
9730 llvm::FoldingSetNodeID DestID;
9731 Dest->Profile(DestID, Context, true);
9732 if (DestID == SizeOfArgID) {
9733 // TODO: For strncpy() and friends, this could suggest sizeof(dst)
9734 // over sizeof(src) as well.
9735 unsigned ActionIdx = 0; // Default is to suggest dereferencing.
9736 StringRef ReadableName = FnName->getName();
9737
9738 if (const UnaryOperator *UnaryOp = dyn_cast<UnaryOperator>(Val: Dest))
9739 if (UnaryOp->getOpcode() == UO_AddrOf)
9740 ActionIdx = 1; // If its an address-of operator, just remove it.
9741 if (!PointeeTy->isIncompleteType() &&
9742 (Context.getTypeSize(T: PointeeTy) == Context.getCharWidth()))
9743 ActionIdx = 2; // If the pointee's size is sizeof(char),
9744 // suggest an explicit length.
9745
9746 // If the function is defined as a builtin macro, do not show macro
9747 // expansion.
9748 SourceLocation SL = SizeOfArg->getExprLoc();
9749 SourceRange DSR = Dest->getSourceRange();
9750 SourceRange SSR = SizeOfArg->getSourceRange();
9751 SourceManager &SM = getSourceManager();
9752
9753 if (SM.isMacroArgExpansion(Loc: SL)) {
9754 ReadableName = Lexer::getImmediateMacroName(Loc: SL, SM, LangOpts);
9755 SL = SM.getSpellingLoc(Loc: SL);
9756 DSR = SourceRange(SM.getSpellingLoc(Loc: DSR.getBegin()),
9757 SM.getSpellingLoc(Loc: DSR.getEnd()));
9758 SSR = SourceRange(SM.getSpellingLoc(Loc: SSR.getBegin()),
9759 SM.getSpellingLoc(Loc: SSR.getEnd()));
9760 }
9761
9762 DiagRuntimeBehavior(SL, SizeOfArg,
9763 PDiag(diag::warn_sizeof_pointer_expr_memaccess)
9764 << ReadableName
9765 << PointeeTy
9766 << DestTy
9767 << DSR
9768 << SSR);
9769 DiagRuntimeBehavior(SL, SizeOfArg,
9770 PDiag(diag::warn_sizeof_pointer_expr_memaccess_note)
9771 << ActionIdx
9772 << SSR);
9773
9774 break;
9775 }
9776 }
9777
9778 // Also check for cases where the sizeof argument is the exact same
9779 // type as the memory argument, and where it points to a user-defined
9780 // record type.
9781 if (SizeOfArgTy != QualType()) {
9782 if (PointeeTy->isRecordType() &&
9783 Context.typesAreCompatible(T1: SizeOfArgTy, T2: DestTy)) {
9784 DiagRuntimeBehavior(LenExpr->getExprLoc(), Dest,
9785 PDiag(diag::warn_sizeof_pointer_type_memaccess)
9786 << FnName << SizeOfArgTy << ArgIdx
9787 << PointeeTy << Dest->getSourceRange()
9788 << LenExpr->getSourceRange());
9789 break;
9790 }
9791 }
9792 } else if (DestTy->isArrayType()) {
9793 PointeeTy = DestTy;
9794 }
9795
9796 if (PointeeTy == QualType())
9797 continue;
9798
9799 // Always complain about dynamic classes.
9800 bool IsContained;
9801 if (const CXXRecordDecl *ContainedRD =
9802 getContainedDynamicClass(T: PointeeTy, IsContained)) {
9803
9804 unsigned OperationType = 0;
9805 const bool IsCmp = BId == Builtin::BImemcmp || BId == Builtin::BIbcmp;
9806 // "overwritten" if we're warning about the destination for any call
9807 // but memcmp; otherwise a verb appropriate to the call.
9808 if (ArgIdx != 0 || IsCmp) {
9809 if (BId == Builtin::BImemcpy)
9810 OperationType = 1;
9811 else if(BId == Builtin::BImemmove)
9812 OperationType = 2;
9813 else if (IsCmp)
9814 OperationType = 3;
9815 }
9816
9817 DiagRuntimeBehavior(Dest->getExprLoc(), Dest,
9818 PDiag(diag::warn_dyn_class_memaccess)
9819 << (IsCmp ? ArgIdx + 2 : ArgIdx) << FnName
9820 << IsContained << ContainedRD << OperationType
9821 << Call->getCallee()->getSourceRange());
9822 } else if (PointeeTy.hasNonTrivialObjCLifetime() &&
9823 BId != Builtin::BImemset)
9824 DiagRuntimeBehavior(
9825 Dest->getExprLoc(), Dest,
9826 PDiag(diag::warn_arc_object_memaccess)
9827 << ArgIdx << FnName << PointeeTy
9828 << Call->getCallee()->getSourceRange());
9829 else if (const auto *RT = PointeeTy->getAs<RecordType>()) {
9830
9831 // FIXME: Do not consider incomplete types even though they may be
9832 // completed later. GCC does not diagnose such code, but we may want to
9833 // consider diagnosing it in the future, perhaps under a different, but
9834 // related, diagnostic group.
9835 bool NonTriviallyCopyableCXXRecord =
9836 getLangOpts().CPlusPlus && !RT->isIncompleteType() &&
9837 !RT->desugar().isTriviallyCopyableType(Context);
9838
9839 if ((BId == Builtin::BImemset || BId == Builtin::BIbzero) &&
9840 RT->getDecl()->isNonTrivialToPrimitiveDefaultInitialize()) {
9841 DiagRuntimeBehavior(Dest->getExprLoc(), Dest,
9842 PDiag(diag::warn_cstruct_memaccess)
9843 << ArgIdx << FnName << PointeeTy << 0);
9844 SearchNonTrivialToInitializeField::diag(RT: PointeeTy, E: Dest, S&: *this);
9845 } else if ((BId == Builtin::BImemset || BId == Builtin::BIbzero) &&
9846 NonTriviallyCopyableCXXRecord && ArgIdx == 0) {
9847 // FIXME: Limiting this warning to dest argument until we decide
9848 // whether it's valid for source argument too.
9849 DiagRuntimeBehavior(Dest->getExprLoc(), Dest,
9850 PDiag(diag::warn_cxxstruct_memaccess)
9851 << FnName << PointeeTy);
9852 } else if ((BId == Builtin::BImemcpy || BId == Builtin::BImemmove) &&
9853 RT->getDecl()->isNonTrivialToPrimitiveCopy()) {
9854 DiagRuntimeBehavior(Dest->getExprLoc(), Dest,
9855 PDiag(diag::warn_cstruct_memaccess)
9856 << ArgIdx << FnName << PointeeTy << 1);
9857 SearchNonTrivialToCopyField::diag(RT: PointeeTy, E: Dest, S&: *this);
9858 } else if ((BId == Builtin::BImemcpy || BId == Builtin::BImemmove) &&
9859 NonTriviallyCopyableCXXRecord && ArgIdx == 0) {
9860 // FIXME: Limiting this warning to dest argument until we decide
9861 // whether it's valid for source argument too.
9862 DiagRuntimeBehavior(Dest->getExprLoc(), Dest,
9863 PDiag(diag::warn_cxxstruct_memaccess)
9864 << FnName << PointeeTy);
9865 } else {
9866 continue;
9867 }
9868 } else
9869 continue;
9870
9871 DiagRuntimeBehavior(
9872 Dest->getExprLoc(), Dest,
9873 PDiag(diag::note_bad_memaccess_silence)
9874 << FixItHint::CreateInsertion(ArgRange.getBegin(), "(void*)"));
9875 break;
9876 }
9877}
9878
9879// A little helper routine: ignore addition and subtraction of integer literals.
9880// This intentionally does not ignore all integer constant expressions because
9881// we don't want to remove sizeof().
9882static const Expr *ignoreLiteralAdditions(const Expr *Ex, ASTContext &Ctx) {
9883 Ex = Ex->IgnoreParenCasts();
9884
9885 while (true) {
9886 const BinaryOperator * BO = dyn_cast<BinaryOperator>(Val: Ex);
9887 if (!BO || !BO->isAdditiveOp())
9888 break;
9889
9890 const Expr *RHS = BO->getRHS()->IgnoreParenCasts();
9891 const Expr *LHS = BO->getLHS()->IgnoreParenCasts();
9892
9893 if (isa<IntegerLiteral>(Val: RHS))
9894 Ex = LHS;
9895 else if (isa<IntegerLiteral>(Val: LHS))
9896 Ex = RHS;
9897 else
9898 break;
9899 }
9900
9901 return Ex;
9902}
9903
9904static bool isConstantSizeArrayWithMoreThanOneElement(QualType Ty,
9905 ASTContext &Context) {
9906 // Only handle constant-sized or VLAs, but not flexible members.
9907 if (const ConstantArrayType *CAT = Context.getAsConstantArrayType(T: Ty)) {
9908 // Only issue the FIXIT for arrays of size > 1.
9909 if (CAT->getZExtSize() <= 1)
9910 return false;
9911 } else if (!Ty->isVariableArrayType()) {
9912 return false;
9913 }
9914 return true;
9915}
9916
9917void Sema::CheckStrlcpycatArguments(const CallExpr *Call,
9918 IdentifierInfo *FnName) {
9919
9920 // Don't crash if the user has the wrong number of arguments
9921 unsigned NumArgs = Call->getNumArgs();
9922 if ((NumArgs != 3) && (NumArgs != 4))
9923 return;
9924
9925 const Expr *SrcArg = ignoreLiteralAdditions(Ex: Call->getArg(Arg: 1), Ctx&: Context);
9926 const Expr *SizeArg = ignoreLiteralAdditions(Ex: Call->getArg(Arg: 2), Ctx&: Context);
9927 const Expr *CompareWithSrc = nullptr;
9928
9929 if (CheckMemorySizeofForComparison(S&: *this, E: SizeArg, FnName,
9930 FnLoc: Call->getBeginLoc(), RParenLoc: Call->getRParenLoc()))
9931 return;
9932
9933 // Look for 'strlcpy(dst, x, sizeof(x))'
9934 if (const Expr *Ex = getSizeOfExprArg(E: SizeArg))
9935 CompareWithSrc = Ex;
9936 else {
9937 // Look for 'strlcpy(dst, x, strlen(x))'
9938 if (const CallExpr *SizeCall = dyn_cast<CallExpr>(Val: SizeArg)) {
9939 if (SizeCall->getBuiltinCallee() == Builtin::BIstrlen &&
9940 SizeCall->getNumArgs() == 1)
9941 CompareWithSrc = ignoreLiteralAdditions(Ex: SizeCall->getArg(Arg: 0), Ctx&: Context);
9942 }
9943 }
9944
9945 if (!CompareWithSrc)
9946 return;
9947
9948 // Determine if the argument to sizeof/strlen is equal to the source
9949 // argument. In principle there's all kinds of things you could do
9950 // here, for instance creating an == expression and evaluating it with
9951 // EvaluateAsBooleanCondition, but this uses a more direct technique:
9952 const DeclRefExpr *SrcArgDRE = dyn_cast<DeclRefExpr>(Val: SrcArg);
9953 if (!SrcArgDRE)
9954 return;
9955
9956 const DeclRefExpr *CompareWithSrcDRE = dyn_cast<DeclRefExpr>(Val: CompareWithSrc);
9957 if (!CompareWithSrcDRE ||
9958 SrcArgDRE->getDecl() != CompareWithSrcDRE->getDecl())
9959 return;
9960
9961 const Expr *OriginalSizeArg = Call->getArg(Arg: 2);
9962 Diag(CompareWithSrcDRE->getBeginLoc(), diag::warn_strlcpycat_wrong_size)
9963 << OriginalSizeArg->getSourceRange() << FnName;
9964
9965 // Output a FIXIT hint if the destination is an array (rather than a
9966 // pointer to an array). This could be enhanced to handle some
9967 // pointers if we know the actual size, like if DstArg is 'array+2'
9968 // we could say 'sizeof(array)-2'.
9969 const Expr *DstArg = Call->getArg(Arg: 0)->IgnoreParenImpCasts();
9970 if (!isConstantSizeArrayWithMoreThanOneElement(Ty: DstArg->getType(), Context))
9971 return;
9972
9973 SmallString<128> sizeString;
9974 llvm::raw_svector_ostream OS(sizeString);
9975 OS << "sizeof(";
9976 DstArg->printPretty(OS, nullptr, getPrintingPolicy());
9977 OS << ")";
9978
9979 Diag(OriginalSizeArg->getBeginLoc(), diag::note_strlcpycat_wrong_size)
9980 << FixItHint::CreateReplacement(OriginalSizeArg->getSourceRange(),
9981 OS.str());
9982}
9983
9984/// Check if two expressions refer to the same declaration.
9985static bool referToTheSameDecl(const Expr *E1, const Expr *E2) {
9986 if (const DeclRefExpr *D1 = dyn_cast_or_null<DeclRefExpr>(Val: E1))
9987 if (const DeclRefExpr *D2 = dyn_cast_or_null<DeclRefExpr>(Val: E2))
9988 return D1->getDecl() == D2->getDecl();
9989 return false;
9990}
9991
9992static const Expr *getStrlenExprArg(const Expr *E) {
9993 if (const CallExpr *CE = dyn_cast<CallExpr>(Val: E)) {
9994 const FunctionDecl *FD = CE->getDirectCallee();
9995 if (!FD || FD->getMemoryFunctionKind() != Builtin::BIstrlen)
9996 return nullptr;
9997 return CE->getArg(Arg: 0)->IgnoreParenCasts();
9998 }
9999 return nullptr;
10000}
10001
10002void Sema::CheckStrncatArguments(const CallExpr *CE,
10003 const IdentifierInfo *FnName) {
10004 // Don't crash if the user has the wrong number of arguments.
10005 if (CE->getNumArgs() < 3)
10006 return;
10007 const Expr *DstArg = CE->getArg(Arg: 0)->IgnoreParenCasts();
10008 const Expr *SrcArg = CE->getArg(Arg: 1)->IgnoreParenCasts();
10009 const Expr *LenArg = CE->getArg(Arg: 2)->IgnoreParenCasts();
10010
10011 if (CheckMemorySizeofForComparison(S&: *this, E: LenArg, FnName, FnLoc: CE->getBeginLoc(),
10012 RParenLoc: CE->getRParenLoc()))
10013 return;
10014
10015 // Identify common expressions, which are wrongly used as the size argument
10016 // to strncat and may lead to buffer overflows.
10017 unsigned PatternType = 0;
10018 if (const Expr *SizeOfArg = getSizeOfExprArg(E: LenArg)) {
10019 // - sizeof(dst)
10020 if (referToTheSameDecl(E1: SizeOfArg, E2: DstArg))
10021 PatternType = 1;
10022 // - sizeof(src)
10023 else if (referToTheSameDecl(E1: SizeOfArg, E2: SrcArg))
10024 PatternType = 2;
10025 } else if (const BinaryOperator *BE = dyn_cast<BinaryOperator>(Val: LenArg)) {
10026 if (BE->getOpcode() == BO_Sub) {
10027 const Expr *L = BE->getLHS()->IgnoreParenCasts();
10028 const Expr *R = BE->getRHS()->IgnoreParenCasts();
10029 // - sizeof(dst) - strlen(dst)
10030 if (referToTheSameDecl(E1: DstArg, E2: getSizeOfExprArg(E: L)) &&
10031 referToTheSameDecl(E1: DstArg, E2: getStrlenExprArg(E: R)))
10032 PatternType = 1;
10033 // - sizeof(src) - (anything)
10034 else if (referToTheSameDecl(E1: SrcArg, E2: getSizeOfExprArg(E: L)))
10035 PatternType = 2;
10036 }
10037 }
10038
10039 if (PatternType == 0)
10040 return;
10041
10042 // Generate the diagnostic.
10043 SourceLocation SL = LenArg->getBeginLoc();
10044 SourceRange SR = LenArg->getSourceRange();
10045 SourceManager &SM = getSourceManager();
10046
10047 // If the function is defined as a builtin macro, do not show macro expansion.
10048 if (SM.isMacroArgExpansion(Loc: SL)) {
10049 SL = SM.getSpellingLoc(Loc: SL);
10050 SR = SourceRange(SM.getSpellingLoc(Loc: SR.getBegin()),
10051 SM.getSpellingLoc(Loc: SR.getEnd()));
10052 }
10053
10054 // Check if the destination is an array (rather than a pointer to an array).
10055 QualType DstTy = DstArg->getType();
10056 bool isKnownSizeArray = isConstantSizeArrayWithMoreThanOneElement(Ty: DstTy,
10057 Context);
10058 if (!isKnownSizeArray) {
10059 if (PatternType == 1)
10060 Diag(SL, diag::warn_strncat_wrong_size) << SR;
10061 else
10062 Diag(SL, diag::warn_strncat_src_size) << SR;
10063 return;
10064 }
10065
10066 if (PatternType == 1)
10067 Diag(SL, diag::warn_strncat_large_size) << SR;
10068 else
10069 Diag(SL, diag::warn_strncat_src_size) << SR;
10070
10071 SmallString<128> sizeString;
10072 llvm::raw_svector_ostream OS(sizeString);
10073 OS << "sizeof(";
10074 DstArg->printPretty(OS, nullptr, getPrintingPolicy());
10075 OS << ") - ";
10076 OS << "strlen(";
10077 DstArg->printPretty(OS, nullptr, getPrintingPolicy());
10078 OS << ") - 1";
10079
10080 Diag(SL, diag::note_strncat_wrong_size)
10081 << FixItHint::CreateReplacement(SR, OS.str());
10082}
10083
10084namespace {
10085void CheckFreeArgumentsOnLvalue(Sema &S, const std::string &CalleeName,
10086 const UnaryOperator *UnaryExpr, const Decl *D) {
10087 if (isa<FieldDecl, FunctionDecl, VarDecl>(Val: D)) {
10088 S.Diag(UnaryExpr->getBeginLoc(), diag::warn_free_nonheap_object)
10089 << CalleeName << 0 /*object: */ << cast<NamedDecl>(D);
10090 return;
10091 }
10092}
10093
10094void CheckFreeArgumentsAddressof(Sema &S, const std::string &CalleeName,
10095 const UnaryOperator *UnaryExpr) {
10096 if (const auto *Lvalue = dyn_cast<DeclRefExpr>(Val: UnaryExpr->getSubExpr())) {
10097 const Decl *D = Lvalue->getDecl();
10098 if (const auto *DD = dyn_cast<DeclaratorDecl>(D)) {
10099 if (!DD->getType()->isReferenceType())
10100 return CheckFreeArgumentsOnLvalue(S, CalleeName, UnaryExpr, D);
10101 }
10102 }
10103
10104 if (const auto *Lvalue = dyn_cast<MemberExpr>(Val: UnaryExpr->getSubExpr()))
10105 return CheckFreeArgumentsOnLvalue(S, CalleeName, UnaryExpr,
10106 Lvalue->getMemberDecl());
10107}
10108
10109void CheckFreeArgumentsPlus(Sema &S, const std::string &CalleeName,
10110 const UnaryOperator *UnaryExpr) {
10111 const auto *Lambda = dyn_cast<LambdaExpr>(
10112 Val: UnaryExpr->getSubExpr()->IgnoreImplicitAsWritten()->IgnoreParens());
10113 if (!Lambda)
10114 return;
10115
10116 S.Diag(Lambda->getBeginLoc(), diag::warn_free_nonheap_object)
10117 << CalleeName << 2 /*object: lambda expression*/;
10118}
10119
10120void CheckFreeArgumentsStackArray(Sema &S, const std::string &CalleeName,
10121 const DeclRefExpr *Lvalue) {
10122 const auto *Var = dyn_cast<VarDecl>(Val: Lvalue->getDecl());
10123 if (Var == nullptr)
10124 return;
10125
10126 S.Diag(Lvalue->getBeginLoc(), diag::warn_free_nonheap_object)
10127 << CalleeName << 0 /*object: */ << Var;
10128}
10129
10130void CheckFreeArgumentsCast(Sema &S, const std::string &CalleeName,
10131 const CastExpr *Cast) {
10132 SmallString<128> SizeString;
10133 llvm::raw_svector_ostream OS(SizeString);
10134
10135 clang::CastKind Kind = Cast->getCastKind();
10136 if (Kind == clang::CK_BitCast &&
10137 !Cast->getSubExpr()->getType()->isFunctionPointerType())
10138 return;
10139 if (Kind == clang::CK_IntegralToPointer &&
10140 !isa<IntegerLiteral>(
10141 Val: Cast->getSubExpr()->IgnoreParenImpCasts()->IgnoreParens()))
10142 return;
10143
10144 switch (Cast->getCastKind()) {
10145 case clang::CK_BitCast:
10146 case clang::CK_IntegralToPointer:
10147 case clang::CK_FunctionToPointerDecay:
10148 OS << '\'';
10149 Cast->printPretty(OS, nullptr, S.getPrintingPolicy());
10150 OS << '\'';
10151 break;
10152 default:
10153 return;
10154 }
10155
10156 S.Diag(Cast->getBeginLoc(), diag::warn_free_nonheap_object)
10157 << CalleeName << 0 /*object: */ << OS.str();
10158}
10159} // namespace
10160
10161void Sema::CheckFreeArguments(const CallExpr *E) {
10162 const std::string CalleeName =
10163 cast<FunctionDecl>(Val: E->getCalleeDecl())->getQualifiedNameAsString();
10164
10165 { // Prefer something that doesn't involve a cast to make things simpler.
10166 const Expr *Arg = E->getArg(Arg: 0)->IgnoreParenCasts();
10167 if (const auto *UnaryExpr = dyn_cast<UnaryOperator>(Val: Arg))
10168 switch (UnaryExpr->getOpcode()) {
10169 case UnaryOperator::Opcode::UO_AddrOf:
10170 return CheckFreeArgumentsAddressof(S&: *this, CalleeName, UnaryExpr);
10171 case UnaryOperator::Opcode::UO_Plus:
10172 return CheckFreeArgumentsPlus(S&: *this, CalleeName, UnaryExpr);
10173 default:
10174 break;
10175 }
10176
10177 if (const auto *Lvalue = dyn_cast<DeclRefExpr>(Val: Arg))
10178 if (Lvalue->getType()->isArrayType())
10179 return CheckFreeArgumentsStackArray(S&: *this, CalleeName, Lvalue);
10180
10181 if (const auto *Label = dyn_cast<AddrLabelExpr>(Val: Arg)) {
10182 Diag(Label->getBeginLoc(), diag::warn_free_nonheap_object)
10183 << CalleeName << 0 /*object: */ << Label->getLabel()->getIdentifier();
10184 return;
10185 }
10186
10187 if (isa<BlockExpr>(Val: Arg)) {
10188 Diag(Arg->getBeginLoc(), diag::warn_free_nonheap_object)
10189 << CalleeName << 1 /*object: block*/;
10190 return;
10191 }
10192 }
10193 // Maybe the cast was important, check after the other cases.
10194 if (const auto *Cast = dyn_cast<CastExpr>(Val: E->getArg(Arg: 0)))
10195 return CheckFreeArgumentsCast(S&: *this, CalleeName, Cast);
10196}
10197
10198void
10199Sema::CheckReturnValExpr(Expr *RetValExp, QualType lhsType,
10200 SourceLocation ReturnLoc,
10201 bool isObjCMethod,
10202 const AttrVec *Attrs,
10203 const FunctionDecl *FD) {
10204 // Check if the return value is null but should not be.
10205 if (((Attrs && hasSpecificAttr<ReturnsNonNullAttr>(*Attrs)) ||
10206 (!isObjCMethod && isNonNullType(lhsType))) &&
10207 CheckNonNullExpr(*this, RetValExp))
10208 Diag(ReturnLoc, diag::warn_null_ret)
10209 << (isObjCMethod ? 1 : 0) << RetValExp->getSourceRange();
10210
10211 // C++11 [basic.stc.dynamic.allocation]p4:
10212 // If an allocation function declared with a non-throwing
10213 // exception-specification fails to allocate storage, it shall return
10214 // a null pointer. Any other allocation function that fails to allocate
10215 // storage shall indicate failure only by throwing an exception [...]
10216 if (FD) {
10217 OverloadedOperatorKind Op = FD->getOverloadedOperator();
10218 if (Op == OO_New || Op == OO_Array_New) {
10219 const FunctionProtoType *Proto
10220 = FD->getType()->castAs<FunctionProtoType>();
10221 if (!Proto->isNothrow(/*ResultIfDependent*/true) &&
10222 CheckNonNullExpr(*this, RetValExp))
10223 Diag(ReturnLoc, diag::warn_operator_new_returns_null)
10224 << FD << getLangOpts().CPlusPlus11;
10225 }
10226 }
10227
10228 if (RetValExp && RetValExp->getType()->isWebAssemblyTableType()) {
10229 Diag(ReturnLoc, diag::err_wasm_table_art) << 1;
10230 }
10231
10232 // PPC MMA non-pointer types are not allowed as return type. Checking the type
10233 // here prevent the user from using a PPC MMA type as trailing return type.
10234 if (Context.getTargetInfo().getTriple().isPPC64())
10235 PPC().CheckPPCMMAType(Type: RetValExp->getType(), TypeLoc: ReturnLoc);
10236}
10237
10238void Sema::CheckFloatComparison(SourceLocation Loc, const Expr *LHS,
10239 const Expr *RHS, BinaryOperatorKind Opcode) {
10240 if (!BinaryOperator::isEqualityOp(Opc: Opcode))
10241 return;
10242
10243 // Match and capture subexpressions such as "(float) X == 0.1".
10244 const FloatingLiteral *FPLiteral;
10245 const CastExpr *FPCast;
10246 auto getCastAndLiteral = [&FPLiteral, &FPCast](const Expr *L, const Expr *R) {
10247 FPLiteral = dyn_cast<FloatingLiteral>(Val: L->IgnoreParens());
10248 FPCast = dyn_cast<CastExpr>(Val: R->IgnoreParens());
10249 return FPLiteral && FPCast;
10250 };
10251
10252 if (getCastAndLiteral(LHS, RHS) || getCastAndLiteral(RHS, LHS)) {
10253 auto *SourceTy = FPCast->getSubExpr()->getType()->getAs<BuiltinType>();
10254 auto *TargetTy = FPLiteral->getType()->getAs<BuiltinType>();
10255 if (SourceTy && TargetTy && SourceTy->isFloatingPoint() &&
10256 TargetTy->isFloatingPoint()) {
10257 bool Lossy;
10258 llvm::APFloat TargetC = FPLiteral->getValue();
10259 TargetC.convert(ToSemantics: Context.getFloatTypeSemantics(T: QualType(SourceTy, 0)),
10260 RM: llvm::APFloat::rmNearestTiesToEven, losesInfo: &Lossy);
10261 if (Lossy) {
10262 // If the literal cannot be represented in the source type, then a
10263 // check for == is always false and check for != is always true.
10264 Diag(Loc, diag::warn_float_compare_literal)
10265 << (Opcode == BO_EQ) << QualType(SourceTy, 0)
10266 << LHS->getSourceRange() << RHS->getSourceRange();
10267 return;
10268 }
10269 }
10270 }
10271
10272 // Match a more general floating-point equality comparison (-Wfloat-equal).
10273 const Expr *LeftExprSansParen = LHS->IgnoreParenImpCasts();
10274 const Expr *RightExprSansParen = RHS->IgnoreParenImpCasts();
10275
10276 // Special case: check for x == x (which is OK).
10277 // Do not emit warnings for such cases.
10278 if (const auto *DRL = dyn_cast<DeclRefExpr>(Val: LeftExprSansParen))
10279 if (const auto *DRR = dyn_cast<DeclRefExpr>(Val: RightExprSansParen))
10280 if (DRL->getDecl() == DRR->getDecl())
10281 return;
10282
10283 // Special case: check for comparisons against literals that can be exactly
10284 // represented by APFloat. In such cases, do not emit a warning. This
10285 // is a heuristic: often comparison against such literals are used to
10286 // detect if a value in a variable has not changed. This clearly can
10287 // lead to false negatives.
10288 if (const auto *FLL = dyn_cast<FloatingLiteral>(Val: LeftExprSansParen)) {
10289 if (FLL->isExact())
10290 return;
10291 } else if (const auto *FLR = dyn_cast<FloatingLiteral>(Val: RightExprSansParen))
10292 if (FLR->isExact())
10293 return;
10294
10295 // Check for comparisons with builtin types.
10296 if (const auto *CL = dyn_cast<CallExpr>(Val: LeftExprSansParen);
10297 CL && CL->getBuiltinCallee())
10298 return;
10299
10300 if (const auto *CR = dyn_cast<CallExpr>(Val: RightExprSansParen);
10301 CR && CR->getBuiltinCallee())
10302 return;
10303
10304 // Emit the diagnostic.
10305 Diag(Loc, diag::warn_floatingpoint_eq)
10306 << LHS->getSourceRange() << RHS->getSourceRange();
10307}
10308
10309//===--- CHECK: Integer mixed-sign comparisons (-Wsign-compare) --------===//
10310//===--- CHECK: Lossy implicit conversions (-Wconversion) --------------===//
10311
10312namespace {
10313
10314/// Structure recording the 'active' range of an integer-valued
10315/// expression.
10316struct IntRange {
10317 /// The number of bits active in the int. Note that this includes exactly one
10318 /// sign bit if !NonNegative.
10319 unsigned Width;
10320
10321 /// True if the int is known not to have negative values. If so, all leading
10322 /// bits before Width are known zero, otherwise they are known to be the
10323 /// same as the MSB within Width.
10324 bool NonNegative;
10325
10326 IntRange(unsigned Width, bool NonNegative)
10327 : Width(Width), NonNegative(NonNegative) {}
10328
10329 /// Number of bits excluding the sign bit.
10330 unsigned valueBits() const {
10331 return NonNegative ? Width : Width - 1;
10332 }
10333
10334 /// Returns the range of the bool type.
10335 static IntRange forBoolType() {
10336 return IntRange(1, true);
10337 }
10338
10339 /// Returns the range of an opaque value of the given integral type.
10340 static IntRange forValueOfType(ASTContext &C, QualType T) {
10341 return forValueOfCanonicalType(C,
10342 T: T->getCanonicalTypeInternal().getTypePtr());
10343 }
10344
10345 /// Returns the range of an opaque value of a canonical integral type.
10346 static IntRange forValueOfCanonicalType(ASTContext &C, const Type *T) {
10347 assert(T->isCanonicalUnqualified());
10348
10349 if (const auto *VT = dyn_cast<VectorType>(Val: T))
10350 T = VT->getElementType().getTypePtr();
10351 if (const auto *CT = dyn_cast<ComplexType>(Val: T))
10352 T = CT->getElementType().getTypePtr();
10353 if (const auto *AT = dyn_cast<AtomicType>(Val: T))
10354 T = AT->getValueType().getTypePtr();
10355
10356 if (!C.getLangOpts().CPlusPlus) {
10357 // For enum types in C code, use the underlying datatype.
10358 if (const auto *ET = dyn_cast<EnumType>(Val: T))
10359 T = ET->getDecl()->getIntegerType().getDesugaredType(Context: C).getTypePtr();
10360 } else if (const auto *ET = dyn_cast<EnumType>(Val: T)) {
10361 // For enum types in C++, use the known bit width of the enumerators.
10362 EnumDecl *Enum = ET->getDecl();
10363 // In C++11, enums can have a fixed underlying type. Use this type to
10364 // compute the range.
10365 if (Enum->isFixed()) {
10366 return IntRange(C.getIntWidth(T: QualType(T, 0)),
10367 !ET->isSignedIntegerOrEnumerationType());
10368 }
10369
10370 unsigned NumPositive = Enum->getNumPositiveBits();
10371 unsigned NumNegative = Enum->getNumNegativeBits();
10372
10373 if (NumNegative == 0)
10374 return IntRange(NumPositive, true/*NonNegative*/);
10375 else
10376 return IntRange(std::max(a: NumPositive + 1, b: NumNegative),
10377 false/*NonNegative*/);
10378 }
10379
10380 if (const auto *EIT = dyn_cast<BitIntType>(Val: T))
10381 return IntRange(EIT->getNumBits(), EIT->isUnsigned());
10382
10383 const BuiltinType *BT = cast<BuiltinType>(Val: T);
10384 assert(BT->isInteger());
10385
10386 return IntRange(C.getIntWidth(T: QualType(T, 0)), BT->isUnsignedInteger());
10387 }
10388
10389 /// Returns the "target" range of a canonical integral type, i.e.
10390 /// the range of values expressible in the type.
10391 ///
10392 /// This matches forValueOfCanonicalType except that enums have the
10393 /// full range of their type, not the range of their enumerators.
10394 static IntRange forTargetOfCanonicalType(ASTContext &C, const Type *T) {
10395 assert(T->isCanonicalUnqualified());
10396
10397 if (const VectorType *VT = dyn_cast<VectorType>(Val: T))
10398 T = VT->getElementType().getTypePtr();
10399 if (const ComplexType *CT = dyn_cast<ComplexType>(Val: T))
10400 T = CT->getElementType().getTypePtr();
10401 if (const AtomicType *AT = dyn_cast<AtomicType>(Val: T))
10402 T = AT->getValueType().getTypePtr();
10403 if (const EnumType *ET = dyn_cast<EnumType>(Val: T))
10404 T = C.getCanonicalType(T: ET->getDecl()->getIntegerType()).getTypePtr();
10405
10406 if (const auto *EIT = dyn_cast<BitIntType>(Val: T))
10407 return IntRange(EIT->getNumBits(), EIT->isUnsigned());
10408
10409 const BuiltinType *BT = cast<BuiltinType>(Val: T);
10410 assert(BT->isInteger());
10411
10412 return IntRange(C.getIntWidth(T: QualType(T, 0)), BT->isUnsignedInteger());
10413 }
10414
10415 /// Returns the supremum of two ranges: i.e. their conservative merge.
10416 static IntRange join(IntRange L, IntRange R) {
10417 bool Unsigned = L.NonNegative && R.NonNegative;
10418 return IntRange(std::max(a: L.valueBits(), b: R.valueBits()) + !Unsigned,
10419 L.NonNegative && R.NonNegative);
10420 }
10421
10422 /// Return the range of a bitwise-AND of the two ranges.
10423 static IntRange bit_and(IntRange L, IntRange R) {
10424 unsigned Bits = std::max(a: L.Width, b: R.Width);
10425 bool NonNegative = false;
10426 if (L.NonNegative) {
10427 Bits = std::min(a: Bits, b: L.Width);
10428 NonNegative = true;
10429 }
10430 if (R.NonNegative) {
10431 Bits = std::min(a: Bits, b: R.Width);
10432 NonNegative = true;
10433 }
10434 return IntRange(Bits, NonNegative);
10435 }
10436
10437 /// Return the range of a sum of the two ranges.
10438 static IntRange sum(IntRange L, IntRange R) {
10439 bool Unsigned = L.NonNegative && R.NonNegative;
10440 return IntRange(std::max(a: L.valueBits(), b: R.valueBits()) + 1 + !Unsigned,
10441 Unsigned);
10442 }
10443
10444 /// Return the range of a difference of the two ranges.
10445 static IntRange difference(IntRange L, IntRange R) {
10446 // We need a 1-bit-wider range if:
10447 // 1) LHS can be negative: least value can be reduced.
10448 // 2) RHS can be negative: greatest value can be increased.
10449 bool CanWiden = !L.NonNegative || !R.NonNegative;
10450 bool Unsigned = L.NonNegative && R.Width == 0;
10451 return IntRange(std::max(a: L.valueBits(), b: R.valueBits()) + CanWiden +
10452 !Unsigned,
10453 Unsigned);
10454 }
10455
10456 /// Return the range of a product of the two ranges.
10457 static IntRange product(IntRange L, IntRange R) {
10458 // If both LHS and RHS can be negative, we can form
10459 // -2^L * -2^R = 2^(L + R)
10460 // which requires L + R + 1 value bits to represent.
10461 bool CanWiden = !L.NonNegative && !R.NonNegative;
10462 bool Unsigned = L.NonNegative && R.NonNegative;
10463 return IntRange(L.valueBits() + R.valueBits() + CanWiden + !Unsigned,
10464 Unsigned);
10465 }
10466
10467 /// Return the range of a remainder operation between the two ranges.
10468 static IntRange rem(IntRange L, IntRange R) {
10469 // The result of a remainder can't be larger than the result of
10470 // either side. The sign of the result is the sign of the LHS.
10471 bool Unsigned = L.NonNegative;
10472 return IntRange(std::min(a: L.valueBits(), b: R.valueBits()) + !Unsigned,
10473 Unsigned);
10474 }
10475};
10476
10477} // namespace
10478
10479static IntRange GetValueRange(llvm::APSInt &value, unsigned MaxWidth) {
10480 if (value.isSigned() && value.isNegative())
10481 return IntRange(value.getSignificantBits(), false);
10482
10483 if (value.getBitWidth() > MaxWidth)
10484 value = value.trunc(width: MaxWidth);
10485
10486 // isNonNegative() just checks the sign bit without considering
10487 // signedness.
10488 return IntRange(value.getActiveBits(), true);
10489}
10490
10491static IntRange GetValueRange(APValue &result, QualType Ty, unsigned MaxWidth) {
10492 if (result.isInt())
10493 return GetValueRange(value&: result.getInt(), MaxWidth);
10494
10495 if (result.isVector()) {
10496 IntRange R = GetValueRange(result&: result.getVectorElt(I: 0), Ty, MaxWidth);
10497 for (unsigned i = 1, e = result.getVectorLength(); i != e; ++i) {
10498 IntRange El = GetValueRange(result&: result.getVectorElt(I: i), Ty, MaxWidth);
10499 R = IntRange::join(L: R, R: El);
10500 }
10501 return R;
10502 }
10503
10504 if (result.isComplexInt()) {
10505 IntRange R = GetValueRange(value&: result.getComplexIntReal(), MaxWidth);
10506 IntRange I = GetValueRange(value&: result.getComplexIntImag(), MaxWidth);
10507 return IntRange::join(L: R, R: I);
10508 }
10509
10510 // This can happen with lossless casts to intptr_t of "based" lvalues.
10511 // Assume it might use arbitrary bits.
10512 // FIXME: The only reason we need to pass the type in here is to get
10513 // the sign right on this one case. It would be nice if APValue
10514 // preserved this.
10515 assert(result.isLValue() || result.isAddrLabelDiff());
10516 return IntRange(MaxWidth, Ty->isUnsignedIntegerOrEnumerationType());
10517}
10518
10519static QualType GetExprType(const Expr *E) {
10520 QualType Ty = E->getType();
10521 if (const auto *AtomicRHS = Ty->getAs<AtomicType>())
10522 Ty = AtomicRHS->getValueType();
10523 return Ty;
10524}
10525
10526/// Attempts to estimate an approximate range for the given integer expression.
10527/// Returns a range if successful, otherwise it returns \c std::nullopt if a
10528/// reliable estimation cannot be determined.
10529///
10530/// \param MaxWidth The width to which the value will be truncated.
10531/// \param InConstantContext If \c true, interpret the expression within a
10532/// constant context.
10533/// \param Approximate If \c true, provide a likely range of values by assuming
10534/// that arithmetic on narrower types remains within those types.
10535/// If \c false, return a range that includes all possible values
10536/// resulting from the expression.
10537/// \returns A range of values that the expression might take, or
10538/// std::nullopt if a reliable estimation cannot be determined.
10539static std::optional<IntRange> TryGetExprRange(ASTContext &C, const Expr *E,
10540 unsigned MaxWidth,
10541 bool InConstantContext,
10542 bool Approximate) {
10543 E = E->IgnoreParens();
10544
10545 // Try a full evaluation first.
10546 Expr::EvalResult result;
10547 if (E->EvaluateAsRValue(Result&: result, Ctx: C, InConstantContext))
10548 return GetValueRange(result&: result.Val, Ty: GetExprType(E), MaxWidth);
10549
10550 // I think we only want to look through implicit casts here; if the
10551 // user has an explicit widening cast, we should treat the value as
10552 // being of the new, wider type.
10553 if (const auto *CE = dyn_cast<ImplicitCastExpr>(Val: E)) {
10554 if (CE->getCastKind() == CK_NoOp || CE->getCastKind() == CK_LValueToRValue)
10555 return TryGetExprRange(C, CE->getSubExpr(), MaxWidth, InConstantContext,
10556 Approximate);
10557
10558 IntRange OutputTypeRange = IntRange::forValueOfType(C, T: GetExprType(CE));
10559
10560 bool isIntegerCast = CE->getCastKind() == CK_IntegralCast ||
10561 CE->getCastKind() == CK_BooleanToSignedIntegral;
10562
10563 // Assume that non-integer casts can span the full range of the type.
10564 if (!isIntegerCast)
10565 return OutputTypeRange;
10566
10567 std::optional<IntRange> SubRange = TryGetExprRange(
10568 C, CE->getSubExpr(), std::min(a: MaxWidth, b: OutputTypeRange.Width),
10569 InConstantContext, Approximate);
10570 if (!SubRange)
10571 return std::nullopt;
10572
10573 // Bail out if the subexpr's range is as wide as the cast type.
10574 if (SubRange->Width >= OutputTypeRange.Width)
10575 return OutputTypeRange;
10576
10577 // Otherwise, we take the smaller width, and we're non-negative if
10578 // either the output type or the subexpr is.
10579 return IntRange(SubRange->Width,
10580 SubRange->NonNegative || OutputTypeRange.NonNegative);
10581 }
10582
10583 if (const auto *CO = dyn_cast<ConditionalOperator>(Val: E)) {
10584 // If we can fold the condition, just take that operand.
10585 bool CondResult;
10586 if (CO->getCond()->EvaluateAsBooleanCondition(Result&: CondResult, Ctx: C))
10587 return TryGetExprRange(
10588 C, E: CondResult ? CO->getTrueExpr() : CO->getFalseExpr(), MaxWidth,
10589 InConstantContext, Approximate);
10590
10591 // Otherwise, conservatively merge.
10592 // TryGetExprRange requires an integer expression, but a throw expression
10593 // results in a void type.
10594 Expr *TrueExpr = CO->getTrueExpr();
10595 if (TrueExpr->getType()->isVoidType())
10596 return std::nullopt;
10597
10598 std::optional<IntRange> L =
10599 TryGetExprRange(C, E: TrueExpr, MaxWidth, InConstantContext, Approximate);
10600 if (!L)
10601 return std::nullopt;
10602
10603 Expr *FalseExpr = CO->getFalseExpr();
10604 if (FalseExpr->getType()->isVoidType())
10605 return std::nullopt;
10606
10607 std::optional<IntRange> R =
10608 TryGetExprRange(C, E: FalseExpr, MaxWidth, InConstantContext, Approximate);
10609 if (!R)
10610 return std::nullopt;
10611
10612 return IntRange::join(L: *L, R: *R);
10613 }
10614
10615 if (const auto *BO = dyn_cast<BinaryOperator>(Val: E)) {
10616 IntRange (*Combine)(IntRange, IntRange) = IntRange::join;
10617
10618 switch (BO->getOpcode()) {
10619 case BO_Cmp:
10620 llvm_unreachable("builtin <=> should have class type");
10621
10622 // Boolean-valued operations are single-bit and positive.
10623 case BO_LAnd:
10624 case BO_LOr:
10625 case BO_LT:
10626 case BO_GT:
10627 case BO_LE:
10628 case BO_GE:
10629 case BO_EQ:
10630 case BO_NE:
10631 return IntRange::forBoolType();
10632
10633 // The type of the assignments is the type of the LHS, so the RHS
10634 // is not necessarily the same type.
10635 case BO_MulAssign:
10636 case BO_DivAssign:
10637 case BO_RemAssign:
10638 case BO_AddAssign:
10639 case BO_SubAssign:
10640 case BO_XorAssign:
10641 case BO_OrAssign:
10642 // TODO: bitfields?
10643 return IntRange::forValueOfType(C, T: GetExprType(E));
10644
10645 // Simple assignments just pass through the RHS, which will have
10646 // been coerced to the LHS type.
10647 case BO_Assign:
10648 // TODO: bitfields?
10649 return TryGetExprRange(C, E: BO->getRHS(), MaxWidth, InConstantContext,
10650 Approximate);
10651
10652 // Operations with opaque sources are black-listed.
10653 case BO_PtrMemD:
10654 case BO_PtrMemI:
10655 return IntRange::forValueOfType(C, T: GetExprType(E));
10656
10657 // Bitwise-and uses the *infinum* of the two source ranges.
10658 case BO_And:
10659 case BO_AndAssign:
10660 Combine = IntRange::bit_and;
10661 break;
10662
10663 // Left shift gets black-listed based on a judgement call.
10664 case BO_Shl:
10665 // ...except that we want to treat '1 << (blah)' as logically
10666 // positive. It's an important idiom.
10667 if (IntegerLiteral *I
10668 = dyn_cast<IntegerLiteral>(Val: BO->getLHS()->IgnoreParenCasts())) {
10669 if (I->getValue() == 1) {
10670 IntRange R = IntRange::forValueOfType(C, T: GetExprType(E));
10671 return IntRange(R.Width, /*NonNegative*/ true);
10672 }
10673 }
10674 [[fallthrough]];
10675
10676 case BO_ShlAssign:
10677 return IntRange::forValueOfType(C, T: GetExprType(E));
10678
10679 // Right shift by a constant can narrow its left argument.
10680 case BO_Shr:
10681 case BO_ShrAssign: {
10682 std::optional<IntRange> L = TryGetExprRange(
10683 C, E: BO->getLHS(), MaxWidth, InConstantContext, Approximate);
10684 if (!L)
10685 return std::nullopt;
10686
10687 // If the shift amount is a positive constant, drop the width by
10688 // that much.
10689 if (std::optional<llvm::APSInt> shift =
10690 BO->getRHS()->getIntegerConstantExpr(Ctx: C)) {
10691 if (shift->isNonNegative()) {
10692 if (shift->uge(RHS: L->Width))
10693 L->Width = (L->NonNegative ? 0 : 1);
10694 else
10695 L->Width -= shift->getZExtValue();
10696 }
10697 }
10698
10699 return L;
10700 }
10701
10702 // Comma acts as its right operand.
10703 case BO_Comma:
10704 return TryGetExprRange(C, E: BO->getRHS(), MaxWidth, InConstantContext,
10705 Approximate);
10706
10707 case BO_Add:
10708 if (!Approximate)
10709 Combine = IntRange::sum;
10710 break;
10711
10712 case BO_Sub:
10713 if (BO->getLHS()->getType()->isPointerType())
10714 return IntRange::forValueOfType(C, T: GetExprType(E));
10715 if (!Approximate)
10716 Combine = IntRange::difference;
10717 break;
10718
10719 case BO_Mul:
10720 if (!Approximate)
10721 Combine = IntRange::product;
10722 break;
10723
10724 // The width of a division result is mostly determined by the size
10725 // of the LHS.
10726 case BO_Div: {
10727 // Don't 'pre-truncate' the operands.
10728 unsigned opWidth = C.getIntWidth(T: GetExprType(E));
10729 std::optional<IntRange> L = TryGetExprRange(
10730 C, E: BO->getLHS(), MaxWidth: opWidth, InConstantContext, Approximate);
10731 if (!L)
10732 return std::nullopt;
10733
10734 // If the divisor is constant, use that.
10735 if (std::optional<llvm::APSInt> divisor =
10736 BO->getRHS()->getIntegerConstantExpr(Ctx: C)) {
10737 unsigned log2 = divisor->logBase2(); // floor(log_2(divisor))
10738 if (log2 >= L->Width)
10739 L->Width = (L->NonNegative ? 0 : 1);
10740 else
10741 L->Width = std::min(a: L->Width - log2, b: MaxWidth);
10742 return L;
10743 }
10744
10745 // Otherwise, just use the LHS's width.
10746 // FIXME: This is wrong if the LHS could be its minimal value and the RHS
10747 // could be -1.
10748 std::optional<IntRange> R = TryGetExprRange(
10749 C, E: BO->getRHS(), MaxWidth: opWidth, InConstantContext, Approximate);
10750 if (!R)
10751 return std::nullopt;
10752
10753 return IntRange(L->Width, L->NonNegative && R->NonNegative);
10754 }
10755
10756 case BO_Rem:
10757 Combine = IntRange::rem;
10758 break;
10759
10760 // The default behavior is okay for these.
10761 case BO_Xor:
10762 case BO_Or:
10763 break;
10764 }
10765
10766 // Combine the two ranges, but limit the result to the type in which we
10767 // performed the computation.
10768 QualType T = GetExprType(E);
10769 unsigned opWidth = C.getIntWidth(T);
10770 std::optional<IntRange> L = TryGetExprRange(C, E: BO->getLHS(), MaxWidth: opWidth,
10771 InConstantContext, Approximate);
10772 if (!L)
10773 return std::nullopt;
10774
10775 std::optional<IntRange> R = TryGetExprRange(C, E: BO->getRHS(), MaxWidth: opWidth,
10776 InConstantContext, Approximate);
10777 if (!R)
10778 return std::nullopt;
10779
10780 IntRange C = Combine(*L, *R);
10781 C.NonNegative |= T->isUnsignedIntegerOrEnumerationType();
10782 C.Width = std::min(a: C.Width, b: MaxWidth);
10783 return C;
10784 }
10785
10786 if (const auto *UO = dyn_cast<UnaryOperator>(Val: E)) {
10787 switch (UO->getOpcode()) {
10788 // Boolean-valued operations are white-listed.
10789 case UO_LNot:
10790 return IntRange::forBoolType();
10791
10792 // Operations with opaque sources are black-listed.
10793 case UO_Deref:
10794 case UO_AddrOf: // should be impossible
10795 return IntRange::forValueOfType(C, T: GetExprType(E));
10796
10797 case UO_Minus: {
10798 if (E->getType()->isUnsignedIntegerType()) {
10799 return TryGetExprRange(C, E: UO->getSubExpr(), MaxWidth, InConstantContext,
10800 Approximate);
10801 }
10802
10803 std::optional<IntRange> SubRange = TryGetExprRange(
10804 C, E: UO->getSubExpr(), MaxWidth, InConstantContext, Approximate);
10805
10806 if (!SubRange)
10807 return std::nullopt;
10808
10809 // If the range was previously non-negative, we need an extra bit for the
10810 // sign bit. If the range was not non-negative, we need an extra bit
10811 // because the negation of the most-negative value is one bit wider than
10812 // that value.
10813 return IntRange(SubRange->Width + 1, false);
10814 }
10815
10816 case UO_Not: {
10817 if (E->getType()->isUnsignedIntegerType()) {
10818 return TryGetExprRange(C, E: UO->getSubExpr(), MaxWidth, InConstantContext,
10819 Approximate);
10820 }
10821
10822 std::optional<IntRange> SubRange = TryGetExprRange(
10823 C, E: UO->getSubExpr(), MaxWidth, InConstantContext, Approximate);
10824
10825 if (!SubRange)
10826 return std::nullopt;
10827
10828 // The width increments by 1 if the sub-expression cannot be negative
10829 // since it now can be.
10830 return IntRange(SubRange->Width + (int)SubRange->NonNegative, false);
10831 }
10832
10833 default:
10834 return TryGetExprRange(C, E: UO->getSubExpr(), MaxWidth, InConstantContext,
10835 Approximate);
10836 }
10837 }
10838
10839 if (const auto *OVE = dyn_cast<OpaqueValueExpr>(Val: E))
10840 return TryGetExprRange(C, E: OVE->getSourceExpr(), MaxWidth, InConstantContext,
10841 Approximate);
10842
10843 if (const auto *BitField = E->getSourceBitField())
10844 return IntRange(BitField->getBitWidthValue(),
10845 BitField->getType()->isUnsignedIntegerOrEnumerationType());
10846
10847 if (GetExprType(E)->isVoidType())
10848 return std::nullopt;
10849
10850 return IntRange::forValueOfType(C, T: GetExprType(E));
10851}
10852
10853static std::optional<IntRange> TryGetExprRange(ASTContext &C, const Expr *E,
10854 bool InConstantContext,
10855 bool Approximate) {
10856 return TryGetExprRange(C, E, MaxWidth: C.getIntWidth(T: GetExprType(E)), InConstantContext,
10857 Approximate);
10858}
10859
10860/// Checks whether the given value, which currently has the given
10861/// source semantics, has the same value when coerced through the
10862/// target semantics.
10863static bool IsSameFloatAfterCast(const llvm::APFloat &value,
10864 const llvm::fltSemantics &Src,
10865 const llvm::fltSemantics &Tgt) {
10866 llvm::APFloat truncated = value;
10867
10868 bool ignored;
10869 truncated.convert(ToSemantics: Src, RM: llvm::APFloat::rmNearestTiesToEven, losesInfo: &ignored);
10870 truncated.convert(ToSemantics: Tgt, RM: llvm::APFloat::rmNearestTiesToEven, losesInfo: &ignored);
10871
10872 return truncated.bitwiseIsEqual(RHS: value);
10873}
10874
10875/// Checks whether the given value, which currently has the given
10876/// source semantics, has the same value when coerced through the
10877/// target semantics.
10878///
10879/// The value might be a vector of floats (or a complex number).
10880static bool IsSameFloatAfterCast(const APValue &value,
10881 const llvm::fltSemantics &Src,
10882 const llvm::fltSemantics &Tgt) {
10883 if (value.isFloat())
10884 return IsSameFloatAfterCast(value: value.getFloat(), Src, Tgt);
10885
10886 if (value.isVector()) {
10887 for (unsigned i = 0, e = value.getVectorLength(); i != e; ++i)
10888 if (!IsSameFloatAfterCast(value: value.getVectorElt(I: i), Src, Tgt))
10889 return false;
10890 return true;
10891 }
10892
10893 assert(value.isComplexFloat());
10894 return (IsSameFloatAfterCast(value: value.getComplexFloatReal(), Src, Tgt) &&
10895 IsSameFloatAfterCast(value: value.getComplexFloatImag(), Src, Tgt));
10896}
10897
10898static void AnalyzeImplicitConversions(Sema &S, Expr *E, SourceLocation CC,
10899 bool IsListInit = false);
10900
10901static bool IsEnumConstOrFromMacro(Sema &S, const Expr *E) {
10902 // Suppress cases where we are comparing against an enum constant.
10903 if (const auto *DR = dyn_cast<DeclRefExpr>(Val: E->IgnoreParenImpCasts()))
10904 if (isa<EnumConstantDecl>(Val: DR->getDecl()))
10905 return true;
10906
10907 // Suppress cases where the value is expanded from a macro, unless that macro
10908 // is how a language represents a boolean literal. This is the case in both C
10909 // and Objective-C.
10910 SourceLocation BeginLoc = E->getBeginLoc();
10911 if (BeginLoc.isMacroID()) {
10912 StringRef MacroName = Lexer::getImmediateMacroName(
10913 Loc: BeginLoc, SM: S.getSourceManager(), LangOpts: S.getLangOpts());
10914 return MacroName != "YES" && MacroName != "NO" &&
10915 MacroName != "true" && MacroName != "false";
10916 }
10917
10918 return false;
10919}
10920
10921static bool isKnownToHaveUnsignedValue(const Expr *E) {
10922 return E->getType()->isIntegerType() &&
10923 (!E->getType()->isSignedIntegerType() ||
10924 !E->IgnoreParenImpCasts()->getType()->isSignedIntegerType());
10925}
10926
10927namespace {
10928/// The promoted range of values of a type. In general this has the
10929/// following structure:
10930///
10931/// |-----------| . . . |-----------|
10932/// ^ ^ ^ ^
10933/// Min HoleMin HoleMax Max
10934///
10935/// ... where there is only a hole if a signed type is promoted to unsigned
10936/// (in which case Min and Max are the smallest and largest representable
10937/// values).
10938struct PromotedRange {
10939 // Min, or HoleMax if there is a hole.
10940 llvm::APSInt PromotedMin;
10941 // Max, or HoleMin if there is a hole.
10942 llvm::APSInt PromotedMax;
10943
10944 PromotedRange(IntRange R, unsigned BitWidth, bool Unsigned) {
10945 if (R.Width == 0)
10946 PromotedMin = PromotedMax = llvm::APSInt(BitWidth, Unsigned);
10947 else if (R.Width >= BitWidth && !Unsigned) {
10948 // Promotion made the type *narrower*. This happens when promoting
10949 // a < 32-bit unsigned / <= 32-bit signed bit-field to 'signed int'.
10950 // Treat all values of 'signed int' as being in range for now.
10951 PromotedMin = llvm::APSInt::getMinValue(numBits: BitWidth, Unsigned);
10952 PromotedMax = llvm::APSInt::getMaxValue(numBits: BitWidth, Unsigned);
10953 } else {
10954 PromotedMin = llvm::APSInt::getMinValue(numBits: R.Width, Unsigned: R.NonNegative)
10955 .extOrTrunc(width: BitWidth);
10956 PromotedMin.setIsUnsigned(Unsigned);
10957
10958 PromotedMax = llvm::APSInt::getMaxValue(numBits: R.Width, Unsigned: R.NonNegative)
10959 .extOrTrunc(width: BitWidth);
10960 PromotedMax.setIsUnsigned(Unsigned);
10961 }
10962 }
10963
10964 // Determine whether this range is contiguous (has no hole).
10965 bool isContiguous() const { return PromotedMin <= PromotedMax; }
10966
10967 // Where a constant value is within the range.
10968 enum ComparisonResult {
10969 LT = 0x1,
10970 LE = 0x2,
10971 GT = 0x4,
10972 GE = 0x8,
10973 EQ = 0x10,
10974 NE = 0x20,
10975 InRangeFlag = 0x40,
10976
10977 Less = LE | LT | NE,
10978 Min = LE | InRangeFlag,
10979 InRange = InRangeFlag,
10980 Max = GE | InRangeFlag,
10981 Greater = GE | GT | NE,
10982
10983 OnlyValue = LE | GE | EQ | InRangeFlag,
10984 InHole = NE
10985 };
10986
10987 ComparisonResult compare(const llvm::APSInt &Value) const {
10988 assert(Value.getBitWidth() == PromotedMin.getBitWidth() &&
10989 Value.isUnsigned() == PromotedMin.isUnsigned());
10990 if (!isContiguous()) {
10991 assert(Value.isUnsigned() && "discontiguous range for signed compare");
10992 if (Value.isMinValue()) return Min;
10993 if (Value.isMaxValue()) return Max;
10994 if (Value >= PromotedMin) return InRange;
10995 if (Value <= PromotedMax) return InRange;
10996 return InHole;
10997 }
10998
10999 switch (llvm::APSInt::compareValues(I1: Value, I2: PromotedMin)) {
11000 case -1: return Less;
11001 case 0: return PromotedMin == PromotedMax ? OnlyValue : Min;
11002 case 1:
11003 switch (llvm::APSInt::compareValues(I1: Value, I2: PromotedMax)) {
11004 case -1: return InRange;
11005 case 0: return Max;
11006 case 1: return Greater;
11007 }
11008 }
11009
11010 llvm_unreachable("impossible compare result");
11011 }
11012
11013 static std::optional<StringRef>
11014 constantValue(BinaryOperatorKind Op, ComparisonResult R, bool ConstantOnRHS) {
11015 if (Op == BO_Cmp) {
11016 ComparisonResult LTFlag = LT, GTFlag = GT;
11017 if (ConstantOnRHS) std::swap(a&: LTFlag, b&: GTFlag);
11018
11019 if (R & EQ) return StringRef("'std::strong_ordering::equal'");
11020 if (R & LTFlag) return StringRef("'std::strong_ordering::less'");
11021 if (R & GTFlag) return StringRef("'std::strong_ordering::greater'");
11022 return std::nullopt;
11023 }
11024
11025 ComparisonResult TrueFlag, FalseFlag;
11026 if (Op == BO_EQ) {
11027 TrueFlag = EQ;
11028 FalseFlag = NE;
11029 } else if (Op == BO_NE) {
11030 TrueFlag = NE;
11031 FalseFlag = EQ;
11032 } else {
11033 if ((Op == BO_LT || Op == BO_GE) ^ ConstantOnRHS) {
11034 TrueFlag = LT;
11035 FalseFlag = GE;
11036 } else {
11037 TrueFlag = GT;
11038 FalseFlag = LE;
11039 }
11040 if (Op == BO_GE || Op == BO_LE)
11041 std::swap(a&: TrueFlag, b&: FalseFlag);
11042 }
11043 if (R & TrueFlag)
11044 return StringRef("true");
11045 if (R & FalseFlag)
11046 return StringRef("false");
11047 return std::nullopt;
11048 }
11049};
11050}
11051
11052static bool HasEnumType(const Expr *E) {
11053 // Strip off implicit integral promotions.
11054 while (const auto *ICE = dyn_cast<ImplicitCastExpr>(Val: E)) {
11055 if (ICE->getCastKind() != CK_IntegralCast &&
11056 ICE->getCastKind() != CK_NoOp)
11057 break;
11058 E = ICE->getSubExpr();
11059 }
11060
11061 return E->getType()->isEnumeralType();
11062}
11063
11064static int classifyConstantValue(Expr *Constant) {
11065 // The values of this enumeration are used in the diagnostics
11066 // diag::warn_out_of_range_compare and diag::warn_tautological_bool_compare.
11067 enum ConstantValueKind {
11068 Miscellaneous = 0,
11069 LiteralTrue,
11070 LiteralFalse
11071 };
11072 if (auto *BL = dyn_cast<CXXBoolLiteralExpr>(Val: Constant))
11073 return BL->getValue() ? ConstantValueKind::LiteralTrue
11074 : ConstantValueKind::LiteralFalse;
11075 return ConstantValueKind::Miscellaneous;
11076}
11077
11078static bool CheckTautologicalComparison(Sema &S, BinaryOperator *E,
11079 Expr *Constant, Expr *Other,
11080 const llvm::APSInt &Value,
11081 bool RhsConstant) {
11082 if (S.inTemplateInstantiation())
11083 return false;
11084
11085 Expr *OriginalOther = Other;
11086
11087 Constant = Constant->IgnoreParenImpCasts();
11088 Other = Other->IgnoreParenImpCasts();
11089
11090 // Suppress warnings on tautological comparisons between values of the same
11091 // enumeration type. There are only two ways we could warn on this:
11092 // - If the constant is outside the range of representable values of
11093 // the enumeration. In such a case, we should warn about the cast
11094 // to enumeration type, not about the comparison.
11095 // - If the constant is the maximum / minimum in-range value. For an
11096 // enumeratin type, such comparisons can be meaningful and useful.
11097 if (Constant->getType()->isEnumeralType() &&
11098 S.Context.hasSameUnqualifiedType(T1: Constant->getType(), T2: Other->getType()))
11099 return false;
11100
11101 std::optional<IntRange> OtherValueRange = TryGetExprRange(
11102 C&: S.Context, E: Other, InConstantContext: S.isConstantEvaluatedContext(), /*Approximate=*/false);
11103 if (!OtherValueRange)
11104 return false;
11105
11106 QualType OtherT = Other->getType();
11107 if (const auto *AT = OtherT->getAs<AtomicType>())
11108 OtherT = AT->getValueType();
11109 IntRange OtherTypeRange = IntRange::forValueOfType(C&: S.Context, T: OtherT);
11110
11111 // Special case for ObjC BOOL on targets where its a typedef for a signed char
11112 // (Namely, macOS). FIXME: IntRange::forValueOfType should do this.
11113 bool IsObjCSignedCharBool = S.getLangOpts().ObjC &&
11114 S.ObjC().NSAPIObj->isObjCBOOLType(T: OtherT) &&
11115 OtherT->isSpecificBuiltinType(K: BuiltinType::SChar);
11116
11117 // Whether we're treating Other as being a bool because of the form of
11118 // expression despite it having another type (typically 'int' in C).
11119 bool OtherIsBooleanDespiteType =
11120 !OtherT->isBooleanType() && Other->isKnownToHaveBooleanValue();
11121 if (OtherIsBooleanDespiteType || IsObjCSignedCharBool)
11122 OtherTypeRange = *OtherValueRange = IntRange::forBoolType();
11123
11124 // Check if all values in the range of possible values of this expression
11125 // lead to the same comparison outcome.
11126 PromotedRange OtherPromotedValueRange(*OtherValueRange, Value.getBitWidth(),
11127 Value.isUnsigned());
11128 auto Cmp = OtherPromotedValueRange.compare(Value);
11129 auto Result = PromotedRange::constantValue(Op: E->getOpcode(), R: Cmp, ConstantOnRHS: RhsConstant);
11130 if (!Result)
11131 return false;
11132
11133 // Also consider the range determined by the type alone. This allows us to
11134 // classify the warning under the proper diagnostic group.
11135 bool TautologicalTypeCompare = false;
11136 {
11137 PromotedRange OtherPromotedTypeRange(OtherTypeRange, Value.getBitWidth(),
11138 Value.isUnsigned());
11139 auto TypeCmp = OtherPromotedTypeRange.compare(Value);
11140 if (auto TypeResult = PromotedRange::constantValue(Op: E->getOpcode(), R: TypeCmp,
11141 ConstantOnRHS: RhsConstant)) {
11142 TautologicalTypeCompare = true;
11143 Cmp = TypeCmp;
11144 Result = TypeResult;
11145 }
11146 }
11147
11148 // Don't warn if the non-constant operand actually always evaluates to the
11149 // same value.
11150 if (!TautologicalTypeCompare && OtherValueRange->Width == 0)
11151 return false;
11152
11153 // Suppress the diagnostic for an in-range comparison if the constant comes
11154 // from a macro or enumerator. We don't want to diagnose
11155 //
11156 // some_long_value <= INT_MAX
11157 //
11158 // when sizeof(int) == sizeof(long).
11159 bool InRange = Cmp & PromotedRange::InRangeFlag;
11160 if (InRange && IsEnumConstOrFromMacro(S, E: Constant))
11161 return false;
11162
11163 // A comparison of an unsigned bit-field against 0 is really a type problem,
11164 // even though at the type level the bit-field might promote to 'signed int'.
11165 if (Other->refersToBitField() && InRange && Value == 0 &&
11166 Other->getType()->isUnsignedIntegerOrEnumerationType())
11167 TautologicalTypeCompare = true;
11168
11169 // If this is a comparison to an enum constant, include that
11170 // constant in the diagnostic.
11171 const EnumConstantDecl *ED = nullptr;
11172 if (const auto *DR = dyn_cast<DeclRefExpr>(Val: Constant))
11173 ED = dyn_cast<EnumConstantDecl>(Val: DR->getDecl());
11174
11175 // Should be enough for uint128 (39 decimal digits)
11176 SmallString<64> PrettySourceValue;
11177 llvm::raw_svector_ostream OS(PrettySourceValue);
11178 if (ED) {
11179 OS << '\'' << *ED << "' (" << Value << ")";
11180 } else if (auto *BL = dyn_cast<ObjCBoolLiteralExpr>(
11181 Val: Constant->IgnoreParenImpCasts())) {
11182 OS << (BL->getValue() ? "YES" : "NO");
11183 } else {
11184 OS << Value;
11185 }
11186
11187 if (!TautologicalTypeCompare) {
11188 S.Diag(E->getOperatorLoc(), diag::warn_tautological_compare_value_range)
11189 << RhsConstant << OtherValueRange->Width << OtherValueRange->NonNegative
11190 << E->getOpcodeStr() << OS.str() << *Result
11191 << E->getLHS()->getSourceRange() << E->getRHS()->getSourceRange();
11192 return true;
11193 }
11194
11195 if (IsObjCSignedCharBool) {
11196 S.DiagRuntimeBehavior(E->getOperatorLoc(), E,
11197 S.PDiag(diag::warn_tautological_compare_objc_bool)
11198 << OS.str() << *Result);
11199 return true;
11200 }
11201
11202 // FIXME: We use a somewhat different formatting for the in-range cases and
11203 // cases involving boolean values for historical reasons. We should pick a
11204 // consistent way of presenting these diagnostics.
11205 if (!InRange || Other->isKnownToHaveBooleanValue()) {
11206
11207 S.DiagRuntimeBehavior(
11208 E->getOperatorLoc(), E,
11209 S.PDiag(!InRange ? diag::warn_out_of_range_compare
11210 : diag::warn_tautological_bool_compare)
11211 << OS.str() << classifyConstantValue(Constant) << OtherT
11212 << OtherIsBooleanDespiteType << *Result
11213 << E->getLHS()->getSourceRange() << E->getRHS()->getSourceRange());
11214 } else {
11215 bool IsCharTy = OtherT.withoutLocalFastQualifiers() == S.Context.CharTy;
11216 unsigned Diag =
11217 (isKnownToHaveUnsignedValue(OriginalOther) && Value == 0)
11218 ? (HasEnumType(OriginalOther)
11219 ? diag::warn_unsigned_enum_always_true_comparison
11220 : IsCharTy ? diag::warn_unsigned_char_always_true_comparison
11221 : diag::warn_unsigned_always_true_comparison)
11222 : diag::warn_tautological_constant_compare;
11223
11224 S.Diag(E->getOperatorLoc(), Diag)
11225 << RhsConstant << OtherT << E->getOpcodeStr() << OS.str() << *Result
11226 << E->getLHS()->getSourceRange() << E->getRHS()->getSourceRange();
11227 }
11228
11229 return true;
11230}
11231
11232/// Analyze the operands of the given comparison. Implements the
11233/// fallback case from AnalyzeComparison.
11234static void AnalyzeImpConvsInComparison(Sema &S, BinaryOperator *E) {
11235 AnalyzeImplicitConversions(S, E: E->getLHS(), CC: E->getOperatorLoc());
11236 AnalyzeImplicitConversions(S, E: E->getRHS(), CC: E->getOperatorLoc());
11237}
11238
11239/// Implements -Wsign-compare.
11240///
11241/// \param E the binary operator to check for warnings
11242static void AnalyzeComparison(Sema &S, BinaryOperator *E) {
11243 // The type the comparison is being performed in.
11244 QualType T = E->getLHS()->getType();
11245
11246 // Only analyze comparison operators where both sides have been converted to
11247 // the same type.
11248 if (!S.Context.hasSameUnqualifiedType(T1: T, T2: E->getRHS()->getType()))
11249 return AnalyzeImpConvsInComparison(S, E);
11250
11251 // Don't analyze value-dependent comparisons directly.
11252 if (E->isValueDependent())
11253 return AnalyzeImpConvsInComparison(S, E);
11254
11255 Expr *LHS = E->getLHS();
11256 Expr *RHS = E->getRHS();
11257
11258 if (T->isIntegralType(Ctx: S.Context)) {
11259 std::optional<llvm::APSInt> RHSValue =
11260 RHS->getIntegerConstantExpr(Ctx: S.Context);
11261 std::optional<llvm::APSInt> LHSValue =
11262 LHS->getIntegerConstantExpr(Ctx: S.Context);
11263
11264 // We don't care about expressions whose result is a constant.
11265 if (RHSValue && LHSValue)
11266 return AnalyzeImpConvsInComparison(S, E);
11267
11268 // We only care about expressions where just one side is literal
11269 if ((bool)RHSValue ^ (bool)LHSValue) {
11270 // Is the constant on the RHS or LHS?
11271 const bool RhsConstant = (bool)RHSValue;
11272 Expr *Const = RhsConstant ? RHS : LHS;
11273 Expr *Other = RhsConstant ? LHS : RHS;
11274 const llvm::APSInt &Value = RhsConstant ? *RHSValue : *LHSValue;
11275
11276 // Check whether an integer constant comparison results in a value
11277 // of 'true' or 'false'.
11278 if (CheckTautologicalComparison(S, E, Constant: Const, Other, Value, RhsConstant))
11279 return AnalyzeImpConvsInComparison(S, E);
11280 }
11281 }
11282
11283 if (!T->hasUnsignedIntegerRepresentation()) {
11284 // We don't do anything special if this isn't an unsigned integral
11285 // comparison: we're only interested in integral comparisons, and
11286 // signed comparisons only happen in cases we don't care to warn about.
11287 return AnalyzeImpConvsInComparison(S, E);
11288 }
11289
11290 LHS = LHS->IgnoreParenImpCasts();
11291 RHS = RHS->IgnoreParenImpCasts();
11292
11293 if (!S.getLangOpts().CPlusPlus) {
11294 // Avoid warning about comparison of integers with different signs when
11295 // RHS/LHS has a `typeof(E)` type whose sign is different from the sign of
11296 // the type of `E`.
11297 if (const auto *TET = dyn_cast<TypeOfExprType>(Val: LHS->getType()))
11298 LHS = TET->getUnderlyingExpr()->IgnoreParenImpCasts();
11299 if (const auto *TET = dyn_cast<TypeOfExprType>(Val: RHS->getType()))
11300 RHS = TET->getUnderlyingExpr()->IgnoreParenImpCasts();
11301 }
11302
11303 // Check to see if one of the (unmodified) operands is of different
11304 // signedness.
11305 Expr *signedOperand, *unsignedOperand;
11306 if (LHS->getType()->hasSignedIntegerRepresentation()) {
11307 assert(!RHS->getType()->hasSignedIntegerRepresentation() &&
11308 "unsigned comparison between two signed integer expressions?");
11309 signedOperand = LHS;
11310 unsignedOperand = RHS;
11311 } else if (RHS->getType()->hasSignedIntegerRepresentation()) {
11312 signedOperand = RHS;
11313 unsignedOperand = LHS;
11314 } else {
11315 return AnalyzeImpConvsInComparison(S, E);
11316 }
11317
11318 // Otherwise, calculate the effective range of the signed operand.
11319 std::optional<IntRange> signedRange =
11320 TryGetExprRange(C&: S.Context, E: signedOperand, InConstantContext: S.isConstantEvaluatedContext(),
11321 /*Approximate=*/true);
11322 if (!signedRange)
11323 return;
11324
11325 // Go ahead and analyze implicit conversions in the operands. Note
11326 // that we skip the implicit conversions on both sides.
11327 AnalyzeImplicitConversions(S, E: LHS, CC: E->getOperatorLoc());
11328 AnalyzeImplicitConversions(S, E: RHS, CC: E->getOperatorLoc());
11329
11330 // If the signed range is non-negative, -Wsign-compare won't fire.
11331 if (signedRange->NonNegative)
11332 return;
11333
11334 // For (in)equality comparisons, if the unsigned operand is a
11335 // constant which cannot collide with a overflowed signed operand,
11336 // then reinterpreting the signed operand as unsigned will not
11337 // change the result of the comparison.
11338 if (E->isEqualityOp()) {
11339 unsigned comparisonWidth = S.Context.getIntWidth(T);
11340 std::optional<IntRange> unsignedRange = TryGetExprRange(
11341 C&: S.Context, E: unsignedOperand, InConstantContext: S.isConstantEvaluatedContext(),
11342 /*Approximate=*/true);
11343 if (!unsignedRange)
11344 return;
11345
11346 // We should never be unable to prove that the unsigned operand is
11347 // non-negative.
11348 assert(unsignedRange->NonNegative && "unsigned range includes negative?");
11349
11350 if (unsignedRange->Width < comparisonWidth)
11351 return;
11352 }
11353
11354 S.DiagRuntimeBehavior(E->getOperatorLoc(), E,
11355 S.PDiag(diag::warn_mixed_sign_comparison)
11356 << LHS->getType() << RHS->getType()
11357 << LHS->getSourceRange() << RHS->getSourceRange());
11358}
11359
11360/// Analyzes an attempt to assign the given value to a bitfield.
11361///
11362/// Returns true if there was something fishy about the attempt.
11363static bool AnalyzeBitFieldAssignment(Sema &S, FieldDecl *Bitfield, Expr *Init,
11364 SourceLocation InitLoc) {
11365 assert(Bitfield->isBitField());
11366 if (Bitfield->isInvalidDecl())
11367 return false;
11368
11369 // White-list bool bitfields.
11370 QualType BitfieldType = Bitfield->getType();
11371 if (BitfieldType->isBooleanType())
11372 return false;
11373
11374 if (BitfieldType->isEnumeralType()) {
11375 EnumDecl *BitfieldEnumDecl = BitfieldType->castAs<EnumType>()->getDecl();
11376 // If the underlying enum type was not explicitly specified as an unsigned
11377 // type and the enum contain only positive values, MSVC++ will cause an
11378 // inconsistency by storing this as a signed type.
11379 if (S.getLangOpts().CPlusPlus11 &&
11380 !BitfieldEnumDecl->getIntegerTypeSourceInfo() &&
11381 BitfieldEnumDecl->getNumPositiveBits() > 0 &&
11382 BitfieldEnumDecl->getNumNegativeBits() == 0) {
11383 S.Diag(InitLoc, diag::warn_no_underlying_type_specified_for_enum_bitfield)
11384 << BitfieldEnumDecl;
11385 }
11386 }
11387
11388 // Ignore value- or type-dependent expressions.
11389 if (Bitfield->getBitWidth()->isValueDependent() ||
11390 Bitfield->getBitWidth()->isTypeDependent() ||
11391 Init->isValueDependent() ||
11392 Init->isTypeDependent())
11393 return false;
11394
11395 Expr *OriginalInit = Init->IgnoreParenImpCasts();
11396 unsigned FieldWidth = Bitfield->getBitWidthValue();
11397
11398 Expr::EvalResult Result;
11399 if (!OriginalInit->EvaluateAsInt(Result, Ctx: S.Context,
11400 AllowSideEffects: Expr::SE_AllowSideEffects)) {
11401 // The RHS is not constant. If the RHS has an enum type, make sure the
11402 // bitfield is wide enough to hold all the values of the enum without
11403 // truncation.
11404 const auto *EnumTy = OriginalInit->getType()->getAs<EnumType>();
11405 const PreferredTypeAttr *PTAttr = nullptr;
11406 if (!EnumTy) {
11407 PTAttr = Bitfield->getAttr<PreferredTypeAttr>();
11408 if (PTAttr)
11409 EnumTy = PTAttr->getType()->getAs<EnumType>();
11410 }
11411 if (EnumTy) {
11412 EnumDecl *ED = EnumTy->getDecl();
11413 bool SignedBitfield = BitfieldType->isSignedIntegerOrEnumerationType();
11414
11415 // Enum types are implicitly signed on Windows, so check if there are any
11416 // negative enumerators to see if the enum was intended to be signed or
11417 // not.
11418 bool SignedEnum = ED->getNumNegativeBits() > 0;
11419
11420 // Check for surprising sign changes when assigning enum values to a
11421 // bitfield of different signedness. If the bitfield is signed and we
11422 // have exactly the right number of bits to store this unsigned enum,
11423 // suggest changing the enum to an unsigned type. This typically happens
11424 // on Windows where unfixed enums always use an underlying type of 'int'.
11425 unsigned DiagID = 0;
11426 if (SignedEnum && !SignedBitfield) {
11427 DiagID =
11428 PTAttr == nullptr
11429 ? diag::warn_unsigned_bitfield_assigned_signed_enum
11430 : diag::
11431 warn_preferred_type_unsigned_bitfield_assigned_signed_enum;
11432 } else if (SignedBitfield && !SignedEnum &&
11433 ED->getNumPositiveBits() == FieldWidth) {
11434 DiagID =
11435 PTAttr == nullptr
11436 ? diag::warn_signed_bitfield_enum_conversion
11437 : diag::warn_preferred_type_signed_bitfield_enum_conversion;
11438 }
11439 if (DiagID) {
11440 S.Diag(InitLoc, DiagID) << Bitfield << ED;
11441 TypeSourceInfo *TSI = Bitfield->getTypeSourceInfo();
11442 SourceRange TypeRange =
11443 TSI ? TSI->getTypeLoc().getSourceRange() : SourceRange();
11444 S.Diag(Bitfield->getTypeSpecStartLoc(), diag::note_change_bitfield_sign)
11445 << SignedEnum << TypeRange;
11446 if (PTAttr)
11447 S.Diag(PTAttr->getLocation(), diag::note_bitfield_preferred_type)
11448 << ED;
11449 }
11450
11451 // Compute the required bitwidth. If the enum has negative values, we need
11452 // one more bit than the normal number of positive bits to represent the
11453 // sign bit.
11454 unsigned BitsNeeded = SignedEnum ? std::max(a: ED->getNumPositiveBits() + 1,
11455 b: ED->getNumNegativeBits())
11456 : ED->getNumPositiveBits();
11457
11458 // Check the bitwidth.
11459 if (BitsNeeded > FieldWidth) {
11460 Expr *WidthExpr = Bitfield->getBitWidth();
11461 auto DiagID =
11462 PTAttr == nullptr
11463 ? diag::warn_bitfield_too_small_for_enum
11464 : diag::warn_preferred_type_bitfield_too_small_for_enum;
11465 S.Diag(InitLoc, DiagID) << Bitfield << ED;
11466 S.Diag(WidthExpr->getExprLoc(), diag::note_widen_bitfield)
11467 << BitsNeeded << ED << WidthExpr->getSourceRange();
11468 if (PTAttr)
11469 S.Diag(PTAttr->getLocation(), diag::note_bitfield_preferred_type)
11470 << ED;
11471 }
11472 }
11473
11474 return false;
11475 }
11476
11477 llvm::APSInt Value = Result.Val.getInt();
11478
11479 unsigned OriginalWidth = Value.getBitWidth();
11480
11481 // In C, the macro 'true' from stdbool.h will evaluate to '1'; To reduce
11482 // false positives where the user is demonstrating they intend to use the
11483 // bit-field as a Boolean, check to see if the value is 1 and we're assigning
11484 // to a one-bit bit-field to see if the value came from a macro named 'true'.
11485 bool OneAssignedToOneBitBitfield = FieldWidth == 1 && Value == 1;
11486 if (OneAssignedToOneBitBitfield && !S.LangOpts.CPlusPlus) {
11487 SourceLocation MaybeMacroLoc = OriginalInit->getBeginLoc();
11488 if (S.SourceMgr.isInSystemMacro(loc: MaybeMacroLoc) &&
11489 S.findMacroSpelling(loc&: MaybeMacroLoc, name: "true"))
11490 return false;
11491 }
11492
11493 if (!Value.isSigned() || Value.isNegative())
11494 if (UnaryOperator *UO = dyn_cast<UnaryOperator>(Val: OriginalInit))
11495 if (UO->getOpcode() == UO_Minus || UO->getOpcode() == UO_Not)
11496 OriginalWidth = Value.getSignificantBits();
11497
11498 if (OriginalWidth <= FieldWidth)
11499 return false;
11500
11501 // Compute the value which the bitfield will contain.
11502 llvm::APSInt TruncatedValue = Value.trunc(width: FieldWidth);
11503 TruncatedValue.setIsSigned(BitfieldType->isSignedIntegerType());
11504
11505 // Check whether the stored value is equal to the original value.
11506 TruncatedValue = TruncatedValue.extend(width: OriginalWidth);
11507 if (llvm::APSInt::isSameValue(I1: Value, I2: TruncatedValue))
11508 return false;
11509
11510 std::string PrettyValue = toString(I: Value, Radix: 10);
11511 std::string PrettyTrunc = toString(I: TruncatedValue, Radix: 10);
11512
11513 S.Diag(InitLoc, OneAssignedToOneBitBitfield
11514 ? diag::warn_impcast_single_bit_bitield_precision_constant
11515 : diag::warn_impcast_bitfield_precision_constant)
11516 << PrettyValue << PrettyTrunc << OriginalInit->getType()
11517 << Init->getSourceRange();
11518
11519 return true;
11520}
11521
11522/// Analyze the given simple or compound assignment for warning-worthy
11523/// operations.
11524static void AnalyzeAssignment(Sema &S, BinaryOperator *E) {
11525 // Just recurse on the LHS.
11526 AnalyzeImplicitConversions(S, E: E->getLHS(), CC: E->getOperatorLoc());
11527
11528 // We want to recurse on the RHS as normal unless we're assigning to
11529 // a bitfield.
11530 if (FieldDecl *Bitfield = E->getLHS()->getSourceBitField()) {
11531 if (AnalyzeBitFieldAssignment(S, Bitfield, Init: E->getRHS(),
11532 InitLoc: E->getOperatorLoc())) {
11533 // Recurse, ignoring any implicit conversions on the RHS.
11534 return AnalyzeImplicitConversions(S, E: E->getRHS()->IgnoreParenImpCasts(),
11535 CC: E->getOperatorLoc());
11536 }
11537 }
11538
11539 AnalyzeImplicitConversions(S, E: E->getRHS(), CC: E->getOperatorLoc());
11540
11541 // Diagnose implicitly sequentially-consistent atomic assignment.
11542 if (E->getLHS()->getType()->isAtomicType())
11543 S.Diag(E->getRHS()->getBeginLoc(), diag::warn_atomic_implicit_seq_cst);
11544}
11545
11546/// Diagnose an implicit cast; purely a helper for CheckImplicitConversion.
11547static void DiagnoseImpCast(Sema &S, const Expr *E, QualType SourceType,
11548 QualType T, SourceLocation CContext, unsigned diag,
11549 bool PruneControlFlow = false) {
11550 // For languages like HLSL and OpenCL, implicit conversion diagnostics listing
11551 // address space annotations isn't really useful. The warnings aren't because
11552 // you're converting a `private int` to `unsigned int`, it is because you're
11553 // conerting `int` to `unsigned int`.
11554 if (SourceType.hasAddressSpace())
11555 SourceType = S.getASTContext().removeAddrSpaceQualType(T: SourceType);
11556 if (T.hasAddressSpace())
11557 T = S.getASTContext().removeAddrSpaceQualType(T);
11558 if (PruneControlFlow) {
11559 S.DiagRuntimeBehavior(E->getExprLoc(), E,
11560 S.PDiag(diag)
11561 << SourceType << T << E->getSourceRange()
11562 << SourceRange(CContext));
11563 return;
11564 }
11565 S.Diag(E->getExprLoc(), diag)
11566 << SourceType << T << E->getSourceRange() << SourceRange(CContext);
11567}
11568
11569/// Diagnose an implicit cast; purely a helper for CheckImplicitConversion.
11570static void DiagnoseImpCast(Sema &S, const Expr *E, QualType T,
11571 SourceLocation CContext, unsigned diag,
11572 bool PruneControlFlow = false) {
11573 DiagnoseImpCast(S, E, SourceType: E->getType(), T, CContext, diag, PruneControlFlow);
11574}
11575
11576/// Diagnose an implicit cast from a floating point value to an integer value.
11577static void DiagnoseFloatingImpCast(Sema &S, const Expr *E, QualType T,
11578 SourceLocation CContext) {
11579 bool IsBool = T->isSpecificBuiltinType(K: BuiltinType::Bool);
11580 bool PruneWarnings = S.inTemplateInstantiation();
11581
11582 const Expr *InnerE = E->IgnoreParenImpCasts();
11583 // We also want to warn on, e.g., "int i = -1.234"
11584 if (const auto *UOp = dyn_cast<UnaryOperator>(Val: InnerE))
11585 if (UOp->getOpcode() == UO_Minus || UOp->getOpcode() == UO_Plus)
11586 InnerE = UOp->getSubExpr()->IgnoreParenImpCasts();
11587
11588 bool IsLiteral = isa<FloatingLiteral>(Val: E) || isa<FloatingLiteral>(Val: InnerE);
11589
11590 llvm::APFloat Value(0.0);
11591 bool IsConstant =
11592 E->EvaluateAsFloat(Result&: Value, Ctx: S.Context, AllowSideEffects: Expr::SE_AllowSideEffects);
11593 if (!IsConstant) {
11594 if (S.ObjC().isSignedCharBool(Ty: T)) {
11595 return S.ObjC().adornBoolConversionDiagWithTernaryFixit(
11596 E, S.Diag(CContext, diag::warn_impcast_float_to_objc_signed_char_bool)
11597 << E->getType());
11598 }
11599
11600 return DiagnoseImpCast(S, E, T, CContext,
11601 diag::warn_impcast_float_integer, PruneWarnings);
11602 }
11603
11604 bool isExact = false;
11605
11606 llvm::APSInt IntegerValue(S.Context.getIntWidth(T),
11607 T->hasUnsignedIntegerRepresentation());
11608 llvm::APFloat::opStatus Result = Value.convertToInteger(
11609 Result&: IntegerValue, RM: llvm::APFloat::rmTowardZero, IsExact: &isExact);
11610
11611 // FIXME: Force the precision of the source value down so we don't print
11612 // digits which are usually useless (we don't really care here if we
11613 // truncate a digit by accident in edge cases). Ideally, APFloat::toString
11614 // would automatically print the shortest representation, but it's a bit
11615 // tricky to implement.
11616 SmallString<16> PrettySourceValue;
11617 unsigned precision = llvm::APFloat::semanticsPrecision(Value.getSemantics());
11618 precision = (precision * 59 + 195) / 196;
11619 Value.toString(Str&: PrettySourceValue, FormatPrecision: precision);
11620
11621 if (S.ObjC().isSignedCharBool(Ty: T) && IntegerValue != 0 && IntegerValue != 1) {
11622 return S.ObjC().adornBoolConversionDiagWithTernaryFixit(
11623 E, S.Diag(CContext, diag::warn_impcast_constant_value_to_objc_bool)
11624 << PrettySourceValue);
11625 }
11626
11627 if (Result == llvm::APFloat::opOK && isExact) {
11628 if (IsLiteral) return;
11629 return DiagnoseImpCast(S, E, T, CContext, diag::warn_impcast_float_integer,
11630 PruneWarnings);
11631 }
11632
11633 // Conversion of a floating-point value to a non-bool integer where the
11634 // integral part cannot be represented by the integer type is undefined.
11635 if (!IsBool && Result == llvm::APFloat::opInvalidOp)
11636 return DiagnoseImpCast(
11637 S, E, T, CContext,
11638 IsLiteral ? diag::warn_impcast_literal_float_to_integer_out_of_range
11639 : diag::warn_impcast_float_to_integer_out_of_range,
11640 PruneWarnings);
11641
11642 unsigned DiagID = 0;
11643 if (IsLiteral) {
11644 // Warn on floating point literal to integer.
11645 DiagID = diag::warn_impcast_literal_float_to_integer;
11646 } else if (IntegerValue == 0) {
11647 if (Value.isZero()) { // Skip -0.0 to 0 conversion.
11648 return DiagnoseImpCast(S, E, T, CContext,
11649 diag::warn_impcast_float_integer, PruneWarnings);
11650 }
11651 // Warn on non-zero to zero conversion.
11652 DiagID = diag::warn_impcast_float_to_integer_zero;
11653 } else {
11654 if (IntegerValue.isUnsigned()) {
11655 if (!IntegerValue.isMaxValue()) {
11656 return DiagnoseImpCast(S, E, T, CContext,
11657 diag::warn_impcast_float_integer, PruneWarnings);
11658 }
11659 } else { // IntegerValue.isSigned()
11660 if (!IntegerValue.isMaxSignedValue() &&
11661 !IntegerValue.isMinSignedValue()) {
11662 return DiagnoseImpCast(S, E, T, CContext,
11663 diag::warn_impcast_float_integer, PruneWarnings);
11664 }
11665 }
11666 // Warn on evaluatable floating point expression to integer conversion.
11667 DiagID = diag::warn_impcast_float_to_integer;
11668 }
11669
11670 SmallString<16> PrettyTargetValue;
11671 if (IsBool)
11672 PrettyTargetValue = Value.isZero() ? "false" : "true";
11673 else
11674 IntegerValue.toString(Str&: PrettyTargetValue);
11675
11676 if (PruneWarnings) {
11677 S.DiagRuntimeBehavior(E->getExprLoc(), E,
11678 S.PDiag(DiagID)
11679 << E->getType() << T.getUnqualifiedType()
11680 << PrettySourceValue << PrettyTargetValue
11681 << E->getSourceRange() << SourceRange(CContext));
11682 } else {
11683 S.Diag(E->getExprLoc(), DiagID)
11684 << E->getType() << T.getUnqualifiedType() << PrettySourceValue
11685 << PrettyTargetValue << E->getSourceRange() << SourceRange(CContext);
11686 }
11687}
11688
11689static void CheckCommaOperand(Sema &S, Expr *E, QualType T, SourceLocation CC,
11690 bool ExtraCheckForImplicitConversion) {
11691 E = E->IgnoreParenImpCasts();
11692 AnalyzeImplicitConversions(S, E, CC);
11693
11694 if (ExtraCheckForImplicitConversion && E->getType() != T)
11695 S.CheckImplicitConversion(E, T, CC);
11696}
11697
11698/// Analyze the given compound assignment for the possible losing of
11699/// floating-point precision.
11700static void AnalyzeCompoundAssignment(Sema &S, BinaryOperator *E) {
11701 assert(isa<CompoundAssignOperator>(E) &&
11702 "Must be compound assignment operation");
11703 // Recurse on the LHS and RHS in here
11704 AnalyzeImplicitConversions(S, E: E->getLHS(), CC: E->getOperatorLoc());
11705 AnalyzeImplicitConversions(S, E: E->getRHS(), CC: E->getOperatorLoc());
11706
11707 if (E->getLHS()->getType()->isAtomicType())
11708 S.Diag(E->getOperatorLoc(), diag::warn_atomic_implicit_seq_cst);
11709
11710 // Now check the outermost expression
11711 const auto *ResultBT = E->getLHS()->getType()->getAs<BuiltinType>();
11712 const auto *RBT = cast<CompoundAssignOperator>(Val: E)
11713 ->getComputationResultType()
11714 ->getAs<BuiltinType>();
11715
11716 // The below checks assume source is floating point.
11717 if (!ResultBT || !RBT || !RBT->isFloatingPoint()) return;
11718
11719 // If source is floating point but target is an integer.
11720 if (ResultBT->isInteger())
11721 return DiagnoseImpCast(S, E, E->getRHS()->getType(), E->getLHS()->getType(),
11722 E->getExprLoc(), diag::warn_impcast_float_integer);
11723
11724 if (!ResultBT->isFloatingPoint())
11725 return;
11726
11727 // If both source and target are floating points, warn about losing precision.
11728 int Order = S.getASTContext().getFloatingTypeSemanticOrder(
11729 LHS: QualType(ResultBT, 0), RHS: QualType(RBT, 0));
11730 if (Order < 0 && !S.SourceMgr.isInSystemMacro(E->getOperatorLoc()))
11731 // warn about dropping FP rank.
11732 DiagnoseImpCast(S, E->getRHS(), E->getLHS()->getType(), E->getOperatorLoc(),
11733 diag::warn_impcast_float_result_precision);
11734}
11735
11736static std::string PrettyPrintInRange(const llvm::APSInt &Value,
11737 IntRange Range) {
11738 if (!Range.Width) return "0";
11739
11740 llvm::APSInt ValueInRange = Value;
11741 ValueInRange.setIsSigned(!Range.NonNegative);
11742 ValueInRange = ValueInRange.trunc(width: Range.Width);
11743 return toString(I: ValueInRange, Radix: 10);
11744}
11745
11746static bool IsImplicitBoolFloatConversion(Sema &S, const Expr *Ex,
11747 bool ToBool) {
11748 if (!isa<ImplicitCastExpr>(Val: Ex))
11749 return false;
11750
11751 const Expr *InnerE = Ex->IgnoreParenImpCasts();
11752 const Type *Target = S.Context.getCanonicalType(T: Ex->getType()).getTypePtr();
11753 const Type *Source =
11754 S.Context.getCanonicalType(T: InnerE->getType()).getTypePtr();
11755 if (Target->isDependentType())
11756 return false;
11757
11758 const auto *FloatCandidateBT =
11759 dyn_cast<BuiltinType>(Val: ToBool ? Source : Target);
11760 const Type *BoolCandidateType = ToBool ? Target : Source;
11761
11762 return (BoolCandidateType->isSpecificBuiltinType(K: BuiltinType::Bool) &&
11763 FloatCandidateBT && (FloatCandidateBT->isFloatingPoint()));
11764}
11765
11766static void CheckImplicitArgumentConversions(Sema &S, const CallExpr *TheCall,
11767 SourceLocation CC) {
11768 for (unsigned I = 0, N = TheCall->getNumArgs(); I < N; ++I) {
11769 const Expr *CurrA = TheCall->getArg(Arg: I);
11770 if (!IsImplicitBoolFloatConversion(S, Ex: CurrA, ToBool: true))
11771 continue;
11772
11773 bool IsSwapped = ((I > 0) && IsImplicitBoolFloatConversion(
11774 S, Ex: TheCall->getArg(Arg: I - 1), ToBool: false));
11775 IsSwapped |= ((I < (N - 1)) && IsImplicitBoolFloatConversion(
11776 S, Ex: TheCall->getArg(Arg: I + 1), ToBool: false));
11777 if (IsSwapped) {
11778 // Warn on this floating-point to bool conversion.
11779 DiagnoseImpCast(S, CurrA->IgnoreParenImpCasts(),
11780 CurrA->getType(), CC,
11781 diag::warn_impcast_floating_point_to_bool);
11782 }
11783 }
11784}
11785
11786static void DiagnoseNullConversion(Sema &S, Expr *E, QualType T,
11787 SourceLocation CC) {
11788 // Don't warn on functions which have return type nullptr_t.
11789 if (isa<CallExpr>(Val: E))
11790 return;
11791
11792 // Check for NULL (GNUNull) or nullptr (CXX11_nullptr).
11793 const Expr *NewE = E->IgnoreParenImpCasts();
11794 bool IsGNUNullExpr = isa<GNUNullExpr>(Val: NewE);
11795 bool HasNullPtrType = NewE->getType()->isNullPtrType();
11796 if (!IsGNUNullExpr && !HasNullPtrType)
11797 return;
11798
11799 // Return if target type is a safe conversion.
11800 if (T->isAnyPointerType() || T->isBlockPointerType() ||
11801 T->isMemberPointerType() || !T->isScalarType() || T->isNullPtrType())
11802 return;
11803
11804 if (S.Diags.isIgnored(diag::warn_impcast_null_pointer_to_integer,
11805 E->getExprLoc()))
11806 return;
11807
11808 SourceLocation Loc = E->getSourceRange().getBegin();
11809
11810 // Venture through the macro stacks to get to the source of macro arguments.
11811 // The new location is a better location than the complete location that was
11812 // passed in.
11813 Loc = S.SourceMgr.getTopMacroCallerLoc(Loc);
11814 CC = S.SourceMgr.getTopMacroCallerLoc(Loc: CC);
11815
11816 // __null is usually wrapped in a macro. Go up a macro if that is the case.
11817 if (IsGNUNullExpr && Loc.isMacroID()) {
11818 StringRef MacroName = Lexer::getImmediateMacroNameForDiagnostics(
11819 Loc, SM: S.SourceMgr, LangOpts: S.getLangOpts());
11820 if (MacroName == "NULL")
11821 Loc = S.SourceMgr.getImmediateExpansionRange(Loc).getBegin();
11822 }
11823
11824 // Only warn if the null and context location are in the same macro expansion.
11825 if (S.SourceMgr.getFileID(SpellingLoc: Loc) != S.SourceMgr.getFileID(SpellingLoc: CC))
11826 return;
11827
11828 S.Diag(Loc, diag::warn_impcast_null_pointer_to_integer)
11829 << HasNullPtrType << T << SourceRange(CC)
11830 << FixItHint::CreateReplacement(Loc,
11831 S.getFixItZeroLiteralForType(T, Loc));
11832}
11833
11834// Helper function to filter out cases for constant width constant conversion.
11835// Don't warn on char array initialization or for non-decimal values.
11836static bool isSameWidthConstantConversion(Sema &S, Expr *E, QualType T,
11837 SourceLocation CC) {
11838 // If initializing from a constant, and the constant starts with '0',
11839 // then it is a binary, octal, or hexadecimal. Allow these constants
11840 // to fill all the bits, even if there is a sign change.
11841 if (auto *IntLit = dyn_cast<IntegerLiteral>(Val: E->IgnoreParenImpCasts())) {
11842 const char FirstLiteralCharacter =
11843 S.getSourceManager().getCharacterData(SL: IntLit->getBeginLoc())[0];
11844 if (FirstLiteralCharacter == '0')
11845 return false;
11846 }
11847
11848 // If the CC location points to a '{', and the type is char, then assume
11849 // assume it is an array initialization.
11850 if (CC.isValid() && T->isCharType()) {
11851 const char FirstContextCharacter =
11852 S.getSourceManager().getCharacterData(SL: CC)[0];
11853 if (FirstContextCharacter == '{')
11854 return false;
11855 }
11856
11857 return true;
11858}
11859
11860static const IntegerLiteral *getIntegerLiteral(Expr *E) {
11861 const auto *IL = dyn_cast<IntegerLiteral>(Val: E);
11862 if (!IL) {
11863 if (auto *UO = dyn_cast<UnaryOperator>(Val: E)) {
11864 if (UO->getOpcode() == UO_Minus)
11865 return dyn_cast<IntegerLiteral>(Val: UO->getSubExpr());
11866 }
11867 }
11868
11869 return IL;
11870}
11871
11872static void DiagnoseIntInBoolContext(Sema &S, Expr *E) {
11873 E = E->IgnoreParenImpCasts();
11874 SourceLocation ExprLoc = E->getExprLoc();
11875
11876 if (const auto *BO = dyn_cast<BinaryOperator>(Val: E)) {
11877 BinaryOperator::Opcode Opc = BO->getOpcode();
11878 Expr::EvalResult Result;
11879 // Do not diagnose unsigned shifts.
11880 if (Opc == BO_Shl) {
11881 const auto *LHS = getIntegerLiteral(E: BO->getLHS());
11882 const auto *RHS = getIntegerLiteral(E: BO->getRHS());
11883 if (LHS && LHS->getValue() == 0)
11884 S.Diag(ExprLoc, diag::warn_left_shift_always) << 0;
11885 else if (!E->isValueDependent() && LHS && RHS &&
11886 RHS->getValue().isNonNegative() &&
11887 E->EvaluateAsInt(Result, S.Context, Expr::SE_AllowSideEffects))
11888 S.Diag(ExprLoc, diag::warn_left_shift_always)
11889 << (Result.Val.getInt() != 0);
11890 else if (E->getType()->isSignedIntegerType())
11891 S.Diag(ExprLoc, diag::warn_left_shift_in_bool_context)
11892 << FixItHint::CreateInsertion(E->getBeginLoc(), "(")
11893 << FixItHint::CreateInsertion(S.getLocForEndOfToken(E->getEndLoc()),
11894 ") != 0");
11895 }
11896 }
11897
11898 if (const auto *CO = dyn_cast<ConditionalOperator>(Val: E)) {
11899 const auto *LHS = getIntegerLiteral(E: CO->getTrueExpr());
11900 const auto *RHS = getIntegerLiteral(E: CO->getFalseExpr());
11901 if (!LHS || !RHS)
11902 return;
11903 if ((LHS->getValue() == 0 || LHS->getValue() == 1) &&
11904 (RHS->getValue() == 0 || RHS->getValue() == 1))
11905 // Do not diagnose common idioms.
11906 return;
11907 if (LHS->getValue() != 0 && RHS->getValue() != 0)
11908 S.Diag(ExprLoc, diag::warn_integer_constants_in_conditional_always_true);
11909 }
11910}
11911
11912static void DiagnoseMixedUnicodeImplicitConversion(Sema &S, const Type *Source,
11913 const Type *Target, Expr *E,
11914 QualType T,
11915 SourceLocation CC) {
11916 assert(Source->isUnicodeCharacterType() && Target->isUnicodeCharacterType() &&
11917 Source != Target);
11918 Expr::EvalResult Result;
11919 if (E->EvaluateAsInt(Result, Ctx: S.getASTContext(), AllowSideEffects: Expr::SE_AllowSideEffects,
11920 InConstantContext: S.isConstantEvaluatedContext())) {
11921 llvm::APSInt Value(32);
11922 Value = Result.Val.getInt();
11923 bool IsASCII = Value <= 0x7F;
11924 bool IsBMP = Value <= 0xD7FF || (Value >= 0xE000 && Value <= 0xFFFF);
11925 bool ConversionPreservesSemantics =
11926 IsASCII || (!Source->isChar8Type() && !Target->isChar8Type() && IsBMP);
11927
11928 if (!ConversionPreservesSemantics) {
11929 auto IsSingleCodeUnitCP = [](const QualType &T,
11930 const llvm::APSInt &Value) {
11931 if (T->isChar8Type())
11932 return llvm::IsSingleCodeUnitUTF8Codepoint(Value.getExtValue());
11933 if (T->isChar16Type())
11934 return llvm::IsSingleCodeUnitUTF16Codepoint(Value.getExtValue());
11935 assert(T->isChar32Type());
11936 return llvm::IsSingleCodeUnitUTF32Codepoint(Value.getExtValue());
11937 };
11938
11939 S.Diag(CC, diag::warn_impcast_unicode_char_type_constant)
11940 << E->getType() << T
11941 << IsSingleCodeUnitCP(E->getType().getUnqualifiedType(), Value)
11942 << FormatUTFCodeUnitAsCodepoint(Value.getExtValue(), E->getType());
11943 }
11944 } else {
11945 bool LosesPrecision = S.getASTContext().getIntWidth(T: E->getType()) >
11946 S.getASTContext().getIntWidth(T);
11947 DiagnoseImpCast(S, E, T, CC,
11948 LosesPrecision ? diag::warn_impcast_unicode_precision
11949 : diag::warn_impcast_unicode_char_type);
11950 }
11951}
11952
11953enum CFIUncheckedCalleeChange {
11954 None,
11955 Adding,
11956 Discarding,
11957};
11958
11959static CFIUncheckedCalleeChange AdjustingCFIUncheckedCallee(QualType From,
11960 QualType To) {
11961 QualType MaybePointee = From->getPointeeType();
11962 if (!MaybePointee.isNull() && MaybePointee->getAs<FunctionType>())
11963 From = MaybePointee;
11964 MaybePointee = To->getPointeeType();
11965 if (!MaybePointee.isNull() && MaybePointee->getAs<FunctionType>())
11966 To = MaybePointee;
11967
11968 if (const auto *FromFn = From->getAs<FunctionType>()) {
11969 if (const auto *ToFn = To->getAs<FunctionType>()) {
11970 if (FromFn->getCFIUncheckedCalleeAttr() &&
11971 !ToFn->getCFIUncheckedCalleeAttr())
11972 return Discarding;
11973 if (!FromFn->getCFIUncheckedCalleeAttr() &&
11974 ToFn->getCFIUncheckedCalleeAttr())
11975 return Adding;
11976 }
11977 }
11978 return None;
11979}
11980
11981bool Sema::DiscardingCFIUncheckedCallee(QualType From, QualType To) const {
11982 From = Context.getCanonicalType(T: From);
11983 To = Context.getCanonicalType(T: To);
11984 return ::AdjustingCFIUncheckedCallee(From, To) == Discarding;
11985}
11986
11987bool Sema::AddingCFIUncheckedCallee(QualType From, QualType To) const {
11988 From = Context.getCanonicalType(T: From);
11989 To = Context.getCanonicalType(T: To);
11990 return ::AdjustingCFIUncheckedCallee(From, To) == Adding;
11991}
11992
11993void Sema::CheckImplicitConversion(Expr *E, QualType T, SourceLocation CC,
11994 bool *ICContext, bool IsListInit) {
11995 if (E->isTypeDependent() || E->isValueDependent()) return;
11996
11997 const Type *Source = Context.getCanonicalType(T: E->getType()).getTypePtr();
11998 const Type *Target = Context.getCanonicalType(T).getTypePtr();
11999 if (Source == Target) return;
12000 if (Target->isDependentType()) return;
12001
12002 // If the conversion context location is invalid don't complain. We also
12003 // don't want to emit a warning if the issue occurs from the expansion of
12004 // a system macro. The problem is that 'getSpellingLoc()' is slow, so we
12005 // delay this check as long as possible. Once we detect we are in that
12006 // scenario, we just return.
12007 if (CC.isInvalid())
12008 return;
12009
12010 if (Source->isAtomicType())
12011 Diag(E->getExprLoc(), diag::warn_atomic_implicit_seq_cst);
12012
12013 // Diagnose implicit casts to bool.
12014 if (Target->isSpecificBuiltinType(K: BuiltinType::Bool)) {
12015 if (isa<StringLiteral>(E))
12016 // Warn on string literal to bool. Checks for string literals in logical
12017 // and expressions, for instance, assert(0 && "error here"), are
12018 // prevented by a check in AnalyzeImplicitConversions().
12019 return DiagnoseImpCast(*this, E, T, CC,
12020 diag::warn_impcast_string_literal_to_bool);
12021 if (isa<ObjCStringLiteral>(Val: E) || isa<ObjCArrayLiteral>(Val: E) ||
12022 isa<ObjCDictionaryLiteral>(Val: E) || isa<ObjCBoxedExpr>(Val: E)) {
12023 // This covers the literal expressions that evaluate to Objective-C
12024 // objects.
12025 return DiagnoseImpCast(*this, E, T, CC,
12026 diag::warn_impcast_objective_c_literal_to_bool);
12027 }
12028 if (Source->isPointerType() || Source->canDecayToPointerType()) {
12029 // Warn on pointer to bool conversion that is always true.
12030 DiagnoseAlwaysNonNullPointer(E, NullType: Expr::NPCK_NotNull, /*IsEqual*/ false,
12031 Range: SourceRange(CC));
12032 }
12033 }
12034
12035 // If the we're converting a constant to an ObjC BOOL on a platform where BOOL
12036 // is a typedef for signed char (macOS), then that constant value has to be 1
12037 // or 0.
12038 if (ObjC().isSignedCharBool(Ty: T) && Source->isIntegralType(Ctx: Context)) {
12039 Expr::EvalResult Result;
12040 if (E->EvaluateAsInt(Result, Ctx: getASTContext(), AllowSideEffects: Expr::SE_AllowSideEffects)) {
12041 if (Result.Val.getInt() != 1 && Result.Val.getInt() != 0) {
12042 ObjC().adornBoolConversionDiagWithTernaryFixit(
12043 E, Diag(CC, diag::warn_impcast_constant_value_to_objc_bool)
12044 << toString(Result.Val.getInt(), 10));
12045 }
12046 return;
12047 }
12048 }
12049
12050 // Check implicit casts from Objective-C collection literals to specialized
12051 // collection types, e.g., NSArray<NSString *> *.
12052 if (auto *ArrayLiteral = dyn_cast<ObjCArrayLiteral>(Val: E))
12053 ObjC().checkArrayLiteral(TargetType: QualType(Target, 0), ArrayLiteral);
12054 else if (auto *DictionaryLiteral = dyn_cast<ObjCDictionaryLiteral>(Val: E))
12055 ObjC().checkDictionaryLiteral(TargetType: QualType(Target, 0), DictionaryLiteral);
12056
12057 // Strip vector types.
12058 if (isa<VectorType>(Val: Source)) {
12059 if (Target->isSveVLSBuiltinType() &&
12060 (Context.areCompatibleSveTypes(FirstType: QualType(Target, 0),
12061 SecondType: QualType(Source, 0)) ||
12062 Context.areLaxCompatibleSveTypes(FirstType: QualType(Target, 0),
12063 SecondType: QualType(Source, 0))))
12064 return;
12065
12066 if (Target->isRVVVLSBuiltinType() &&
12067 (Context.areCompatibleRVVTypes(FirstType: QualType(Target, 0),
12068 SecondType: QualType(Source, 0)) ||
12069 Context.areLaxCompatibleRVVTypes(FirstType: QualType(Target, 0),
12070 SecondType: QualType(Source, 0))))
12071 return;
12072
12073 if (!isa<VectorType>(Val: Target)) {
12074 if (SourceMgr.isInSystemMacro(loc: CC))
12075 return;
12076 return DiagnoseImpCast(*this, E, T, CC, diag::warn_impcast_vector_scalar);
12077 } else if (getLangOpts().HLSL &&
12078 Target->castAs<VectorType>()->getNumElements() <
12079 Source->castAs<VectorType>()->getNumElements()) {
12080 // Diagnose vector truncation but don't return. We may also want to
12081 // diagnose an element conversion.
12082 DiagnoseImpCast(*this, E, T, CC,
12083 diag::warn_hlsl_impcast_vector_truncation);
12084 }
12085
12086 // If the vector cast is cast between two vectors of the same size, it is
12087 // a bitcast, not a conversion, except under HLSL where it is a conversion.
12088 if (!getLangOpts().HLSL &&
12089 Context.getTypeSize(T: Source) == Context.getTypeSize(T: Target))
12090 return;
12091
12092 Source = cast<VectorType>(Val: Source)->getElementType().getTypePtr();
12093 Target = cast<VectorType>(Val: Target)->getElementType().getTypePtr();
12094 }
12095 if (auto VecTy = dyn_cast<VectorType>(Val: Target))
12096 Target = VecTy->getElementType().getTypePtr();
12097
12098 // Strip complex types.
12099 if (isa<ComplexType>(Val: Source)) {
12100 if (!isa<ComplexType>(Val: Target)) {
12101 if (SourceMgr.isInSystemMacro(loc: CC) || Target->isBooleanType())
12102 return;
12103
12104 return DiagnoseImpCast(*this, E, T, CC,
12105 getLangOpts().CPlusPlus
12106 ? diag::err_impcast_complex_scalar
12107 : diag::warn_impcast_complex_scalar);
12108 }
12109
12110 Source = cast<ComplexType>(Val: Source)->getElementType().getTypePtr();
12111 Target = cast<ComplexType>(Val: Target)->getElementType().getTypePtr();
12112 }
12113
12114 const BuiltinType *SourceBT = dyn_cast<BuiltinType>(Val: Source);
12115 const BuiltinType *TargetBT = dyn_cast<BuiltinType>(Val: Target);
12116
12117 // Strip SVE vector types
12118 if (SourceBT && SourceBT->isSveVLSBuiltinType()) {
12119 // Need the original target type for vector type checks
12120 const Type *OriginalTarget = Context.getCanonicalType(T).getTypePtr();
12121 // Handle conversion from scalable to fixed when msve-vector-bits is
12122 // specified
12123 if (Context.areCompatibleSveTypes(FirstType: QualType(OriginalTarget, 0),
12124 SecondType: QualType(Source, 0)) ||
12125 Context.areLaxCompatibleSveTypes(FirstType: QualType(OriginalTarget, 0),
12126 SecondType: QualType(Source, 0)))
12127 return;
12128
12129 // If the vector cast is cast between two vectors of the same size, it is
12130 // a bitcast, not a conversion.
12131 if (Context.getTypeSize(T: Source) == Context.getTypeSize(T: Target))
12132 return;
12133
12134 Source = SourceBT->getSveEltType(Context).getTypePtr();
12135 }
12136
12137 if (TargetBT && TargetBT->isSveVLSBuiltinType())
12138 Target = TargetBT->getSveEltType(Context).getTypePtr();
12139
12140 // If the source is floating point...
12141 if (SourceBT && SourceBT->isFloatingPoint()) {
12142 // ...and the target is floating point...
12143 if (TargetBT && TargetBT->isFloatingPoint()) {
12144 // ...then warn if we're dropping FP rank.
12145
12146 int Order = getASTContext().getFloatingTypeSemanticOrder(
12147 LHS: QualType(SourceBT, 0), RHS: QualType(TargetBT, 0));
12148 if (Order > 0) {
12149 // Don't warn about float constants that are precisely
12150 // representable in the target type.
12151 Expr::EvalResult result;
12152 if (E->EvaluateAsRValue(Result&: result, Ctx: Context)) {
12153 // Value might be a float, a float vector, or a float complex.
12154 if (IsSameFloatAfterCast(
12155 value: result.Val,
12156 Src: Context.getFloatTypeSemantics(T: QualType(TargetBT, 0)),
12157 Tgt: Context.getFloatTypeSemantics(T: QualType(SourceBT, 0))))
12158 return;
12159 }
12160
12161 if (SourceMgr.isInSystemMacro(loc: CC))
12162 return;
12163
12164 DiagnoseImpCast(*this, E, T, CC, diag::warn_impcast_float_precision);
12165 }
12166 // ... or possibly if we're increasing rank, too
12167 else if (Order < 0) {
12168 if (SourceMgr.isInSystemMacro(loc: CC))
12169 return;
12170
12171 DiagnoseImpCast(*this, E, T, CC, diag::warn_impcast_double_promotion);
12172 }
12173 return;
12174 }
12175
12176 // If the target is integral, always warn.
12177 if (TargetBT && TargetBT->isInteger()) {
12178 if (SourceMgr.isInSystemMacro(loc: CC))
12179 return;
12180
12181 DiagnoseFloatingImpCast(S&: *this, E, T, CContext: CC);
12182 }
12183
12184 // Detect the case where a call result is converted from floating-point to
12185 // to bool, and the final argument to the call is converted from bool, to
12186 // discover this typo:
12187 //
12188 // bool b = fabs(x < 1.0); // should be "bool b = fabs(x) < 1.0;"
12189 //
12190 // FIXME: This is an incredibly special case; is there some more general
12191 // way to detect this class of misplaced-parentheses bug?
12192 if (Target->isBooleanType() && isa<CallExpr>(Val: E)) {
12193 // Check last argument of function call to see if it is an
12194 // implicit cast from a type matching the type the result
12195 // is being cast to.
12196 CallExpr *CEx = cast<CallExpr>(Val: E);
12197 if (unsigned NumArgs = CEx->getNumArgs()) {
12198 Expr *LastA = CEx->getArg(Arg: NumArgs - 1);
12199 Expr *InnerE = LastA->IgnoreParenImpCasts();
12200 if (isa<ImplicitCastExpr>(Val: LastA) &&
12201 InnerE->getType()->isBooleanType()) {
12202 // Warn on this floating-point to bool conversion
12203 DiagnoseImpCast(*this, E, T, CC,
12204 diag::warn_impcast_floating_point_to_bool);
12205 }
12206 }
12207 }
12208 return;
12209 }
12210
12211 // Valid casts involving fixed point types should be accounted for here.
12212 if (Source->isFixedPointType()) {
12213 if (Target->isUnsaturatedFixedPointType()) {
12214 Expr::EvalResult Result;
12215 if (E->EvaluateAsFixedPoint(Result, Ctx: Context, AllowSideEffects: Expr::SE_AllowSideEffects,
12216 InConstantContext: isConstantEvaluatedContext())) {
12217 llvm::APFixedPoint Value = Result.Val.getFixedPoint();
12218 llvm::APFixedPoint MaxVal = Context.getFixedPointMax(Ty: T);
12219 llvm::APFixedPoint MinVal = Context.getFixedPointMin(Ty: T);
12220 if (Value > MaxVal || Value < MinVal) {
12221 DiagRuntimeBehavior(E->getExprLoc(), E,
12222 PDiag(diag::warn_impcast_fixed_point_range)
12223 << Value.toString() << T
12224 << E->getSourceRange()
12225 << clang::SourceRange(CC));
12226 return;
12227 }
12228 }
12229 } else if (Target->isIntegerType()) {
12230 Expr::EvalResult Result;
12231 if (!isConstantEvaluatedContext() &&
12232 E->EvaluateAsFixedPoint(Result, Ctx: Context, AllowSideEffects: Expr::SE_AllowSideEffects)) {
12233 llvm::APFixedPoint FXResult = Result.Val.getFixedPoint();
12234
12235 bool Overflowed;
12236 llvm::APSInt IntResult = FXResult.convertToInt(
12237 DstWidth: Context.getIntWidth(T), DstSign: Target->isSignedIntegerOrEnumerationType(),
12238 Overflow: &Overflowed);
12239
12240 if (Overflowed) {
12241 DiagRuntimeBehavior(E->getExprLoc(), E,
12242 PDiag(diag::warn_impcast_fixed_point_range)
12243 << FXResult.toString() << T
12244 << E->getSourceRange()
12245 << clang::SourceRange(CC));
12246 return;
12247 }
12248 }
12249 }
12250 } else if (Target->isUnsaturatedFixedPointType()) {
12251 if (Source->isIntegerType()) {
12252 Expr::EvalResult Result;
12253 if (!isConstantEvaluatedContext() &&
12254 E->EvaluateAsInt(Result, Ctx: Context, AllowSideEffects: Expr::SE_AllowSideEffects)) {
12255 llvm::APSInt Value = Result.Val.getInt();
12256
12257 bool Overflowed;
12258 llvm::APFixedPoint IntResult = llvm::APFixedPoint::getFromIntValue(
12259 Value, DstFXSema: Context.getFixedPointSemantics(Ty: T), Overflow: &Overflowed);
12260
12261 if (Overflowed) {
12262 DiagRuntimeBehavior(E->getExprLoc(), E,
12263 PDiag(diag::warn_impcast_fixed_point_range)
12264 << toString(Value, /*Radix=*/10) << T
12265 << E->getSourceRange()
12266 << clang::SourceRange(CC));
12267 return;
12268 }
12269 }
12270 }
12271 }
12272
12273 // If we are casting an integer type to a floating point type without
12274 // initialization-list syntax, we might lose accuracy if the floating
12275 // point type has a narrower significand than the integer type.
12276 if (SourceBT && TargetBT && SourceBT->isIntegerType() &&
12277 TargetBT->isFloatingType() && !IsListInit) {
12278 // Determine the number of precision bits in the source integer type.
12279 std::optional<IntRange> SourceRange =
12280 TryGetExprRange(C&: Context, E, InConstantContext: isConstantEvaluatedContext(),
12281 /*Approximate=*/true);
12282 if (!SourceRange)
12283 return;
12284 unsigned int SourcePrecision = SourceRange->Width;
12285
12286 // Determine the number of precision bits in the
12287 // target floating point type.
12288 unsigned int TargetPrecision = llvm::APFloatBase::semanticsPrecision(
12289 Context.getFloatTypeSemantics(T: QualType(TargetBT, 0)));
12290
12291 if (SourcePrecision > 0 && TargetPrecision > 0 &&
12292 SourcePrecision > TargetPrecision) {
12293
12294 if (std::optional<llvm::APSInt> SourceInt =
12295 E->getIntegerConstantExpr(Ctx: Context)) {
12296 // If the source integer is a constant, convert it to the target
12297 // floating point type. Issue a warning if the value changes
12298 // during the whole conversion.
12299 llvm::APFloat TargetFloatValue(
12300 Context.getFloatTypeSemantics(T: QualType(TargetBT, 0)));
12301 llvm::APFloat::opStatus ConversionStatus =
12302 TargetFloatValue.convertFromAPInt(
12303 Input: *SourceInt, IsSigned: SourceBT->isSignedInteger(),
12304 RM: llvm::APFloat::rmNearestTiesToEven);
12305
12306 if (ConversionStatus != llvm::APFloat::opOK) {
12307 SmallString<32> PrettySourceValue;
12308 SourceInt->toString(Str&: PrettySourceValue, Radix: 10);
12309 SmallString<32> PrettyTargetValue;
12310 TargetFloatValue.toString(Str&: PrettyTargetValue, FormatPrecision: TargetPrecision);
12311
12312 DiagRuntimeBehavior(
12313 E->getExprLoc(), E,
12314 PDiag(diag::warn_impcast_integer_float_precision_constant)
12315 << PrettySourceValue << PrettyTargetValue << E->getType() << T
12316 << E->getSourceRange() << clang::SourceRange(CC));
12317 }
12318 } else {
12319 // Otherwise, the implicit conversion may lose precision.
12320 DiagnoseImpCast(*this, E, T, CC,
12321 diag::warn_impcast_integer_float_precision);
12322 }
12323 }
12324 }
12325
12326 DiagnoseNullConversion(S&: *this, E, T, CC);
12327
12328 DiscardMisalignedMemberAddress(T: Target, E);
12329
12330 if (Source->isUnicodeCharacterType() && Target->isUnicodeCharacterType()) {
12331 DiagnoseMixedUnicodeImplicitConversion(S&: *this, Source, Target, E, T, CC);
12332 return;
12333 }
12334
12335 if (Target->isBooleanType())
12336 DiagnoseIntInBoolContext(S&: *this, E);
12337
12338 if (DiscardingCFIUncheckedCallee(From: QualType(Source, 0), To: QualType(Target, 0))) {
12339 Diag(CC, diag::warn_cast_discards_cfi_unchecked_callee)
12340 << QualType(Source, 0) << QualType(Target, 0);
12341 }
12342
12343 if (!Source->isIntegerType() || !Target->isIntegerType())
12344 return;
12345
12346 // TODO: remove this early return once the false positives for constant->bool
12347 // in templates, macros, etc, are reduced or removed.
12348 if (Target->isSpecificBuiltinType(K: BuiltinType::Bool))
12349 return;
12350
12351 if (ObjC().isSignedCharBool(Ty: T) && !Source->isCharType() &&
12352 !E->isKnownToHaveBooleanValue(/*Semantic=*/false)) {
12353 return ObjC().adornBoolConversionDiagWithTernaryFixit(
12354 E, Diag(CC, diag::warn_impcast_int_to_objc_signed_char_bool)
12355 << E->getType());
12356 }
12357 std::optional<IntRange> LikelySourceRange = TryGetExprRange(
12358 C&: Context, E, InConstantContext: isConstantEvaluatedContext(), /*Approximate=*/true);
12359 if (!LikelySourceRange)
12360 return;
12361
12362 IntRange SourceTypeRange =
12363 IntRange::forTargetOfCanonicalType(C&: Context, T: Source);
12364 IntRange TargetRange = IntRange::forTargetOfCanonicalType(C&: Context, T: Target);
12365
12366 if (LikelySourceRange->Width > TargetRange.Width) {
12367 // If the source is a constant, use a default-on diagnostic.
12368 // TODO: this should happen for bitfield stores, too.
12369 Expr::EvalResult Result;
12370 if (E->EvaluateAsInt(Result, Ctx: Context, AllowSideEffects: Expr::SE_AllowSideEffects,
12371 InConstantContext: isConstantEvaluatedContext())) {
12372 llvm::APSInt Value(32);
12373 Value = Result.Val.getInt();
12374
12375 if (SourceMgr.isInSystemMacro(loc: CC))
12376 return;
12377
12378 std::string PrettySourceValue = toString(I: Value, Radix: 10);
12379 std::string PrettyTargetValue = PrettyPrintInRange(Value, Range: TargetRange);
12380
12381 DiagRuntimeBehavior(E->getExprLoc(), E,
12382 PDiag(diag::warn_impcast_integer_precision_constant)
12383 << PrettySourceValue << PrettyTargetValue
12384 << E->getType() << T << E->getSourceRange()
12385 << SourceRange(CC));
12386 return;
12387 }
12388
12389 // People want to build with -Wshorten-64-to-32 and not -Wconversion.
12390 if (SourceMgr.isInSystemMacro(loc: CC))
12391 return;
12392
12393 if (const auto *UO = dyn_cast<UnaryOperator>(Val: E)) {
12394 if (UO->getOpcode() == UO_Minus)
12395 return DiagnoseImpCast(
12396 *this, E, T, CC, diag::warn_impcast_integer_precision_on_negation);
12397 }
12398
12399 if (TargetRange.Width == 32 && Context.getIntWidth(E->getType()) == 64)
12400 return DiagnoseImpCast(*this, E, T, CC, diag::warn_impcast_integer_64_32,
12401 /* pruneControlFlow */ true);
12402 return DiagnoseImpCast(*this, E, T, CC,
12403 diag::warn_impcast_integer_precision);
12404 }
12405
12406 if (TargetRange.Width > SourceTypeRange.Width) {
12407 if (auto *UO = dyn_cast<UnaryOperator>(Val: E))
12408 if (UO->getOpcode() == UO_Minus)
12409 if (Source->isUnsignedIntegerType()) {
12410 if (Target->isUnsignedIntegerType())
12411 return DiagnoseImpCast(*this, E, T, CC,
12412 diag::warn_impcast_high_order_zero_bits);
12413 if (Target->isSignedIntegerType())
12414 return DiagnoseImpCast(*this, E, T, CC,
12415 diag::warn_impcast_nonnegative_result);
12416 }
12417 }
12418
12419 if (TargetRange.Width == LikelySourceRange->Width &&
12420 !TargetRange.NonNegative && LikelySourceRange->NonNegative &&
12421 Source->isSignedIntegerType()) {
12422 // Warn when doing a signed to signed conversion, warn if the positive
12423 // source value is exactly the width of the target type, which will
12424 // cause a negative value to be stored.
12425
12426 Expr::EvalResult Result;
12427 if (E->EvaluateAsInt(Result, Ctx: Context, AllowSideEffects: Expr::SE_AllowSideEffects) &&
12428 !SourceMgr.isInSystemMacro(loc: CC)) {
12429 llvm::APSInt Value = Result.Val.getInt();
12430 if (isSameWidthConstantConversion(S&: *this, E, T, CC)) {
12431 std::string PrettySourceValue = toString(I: Value, Radix: 10);
12432 std::string PrettyTargetValue = PrettyPrintInRange(Value, Range: TargetRange);
12433
12434 Diag(E->getExprLoc(),
12435 PDiag(diag::warn_impcast_integer_precision_constant)
12436 << PrettySourceValue << PrettyTargetValue << E->getType() << T
12437 << E->getSourceRange() << SourceRange(CC));
12438 return;
12439 }
12440 }
12441
12442 // Fall through for non-constants to give a sign conversion warning.
12443 }
12444
12445 if ((!isa<EnumType>(Val: Target) || !isa<EnumType>(Val: Source)) &&
12446 ((TargetRange.NonNegative && !LikelySourceRange->NonNegative) ||
12447 (!TargetRange.NonNegative && LikelySourceRange->NonNegative &&
12448 LikelySourceRange->Width == TargetRange.Width))) {
12449 if (SourceMgr.isInSystemMacro(loc: CC))
12450 return;
12451
12452 if (SourceBT && SourceBT->isInteger() && TargetBT &&
12453 TargetBT->isInteger() &&
12454 Source->isSignedIntegerType() == Target->isSignedIntegerType()) {
12455 return;
12456 }
12457
12458 unsigned DiagID = diag::warn_impcast_integer_sign;
12459
12460 // Traditionally, gcc has warned about this under -Wsign-compare.
12461 // We also want to warn about it in -Wconversion.
12462 // So if -Wconversion is off, use a completely identical diagnostic
12463 // in the sign-compare group.
12464 // The conditional-checking code will
12465 if (ICContext) {
12466 DiagID = diag::warn_impcast_integer_sign_conditional;
12467 *ICContext = true;
12468 }
12469
12470 DiagnoseImpCast(S&: *this, E, T, CContext: CC, diag: DiagID);
12471 }
12472
12473 // If we're implicitly converting from an integer into an enumeration, that
12474 // is valid in C but invalid in C++.
12475 QualType SourceType = E->getEnumCoercedType(Ctx: Context);
12476 const BuiltinType *CoercedSourceBT = SourceType->getAs<BuiltinType>();
12477 if (CoercedSourceBT && CoercedSourceBT->isInteger() && isa<EnumType>(Target))
12478 return DiagnoseImpCast(*this, E, T, CC, diag::warn_impcast_int_to_enum);
12479
12480 // Diagnose conversions between different enumeration types.
12481 // In C, we pretend that the type of an EnumConstantDecl is its enumeration
12482 // type, to give us better diagnostics.
12483 Source = Context.getCanonicalType(T: SourceType).getTypePtr();
12484
12485 if (const EnumType *SourceEnum = Source->getAs<EnumType>())
12486 if (const EnumType *TargetEnum = Target->getAs<EnumType>())
12487 if (SourceEnum->getDecl()->hasNameForLinkage() &&
12488 TargetEnum->getDecl()->hasNameForLinkage() &&
12489 SourceEnum != TargetEnum) {
12490 if (SourceMgr.isInSystemMacro(loc: CC))
12491 return;
12492
12493 return DiagnoseImpCast(*this, E, SourceType, T, CC,
12494 diag::warn_impcast_different_enum_types);
12495 }
12496}
12497
12498static void CheckConditionalOperator(Sema &S, AbstractConditionalOperator *E,
12499 SourceLocation CC, QualType T);
12500
12501static void CheckConditionalOperand(Sema &S, Expr *E, QualType T,
12502 SourceLocation CC, bool &ICContext) {
12503 E = E->IgnoreParenImpCasts();
12504 // Diagnose incomplete type for second or third operand in C.
12505 if (!S.getLangOpts().CPlusPlus && E->getType()->isRecordType())
12506 S.RequireCompleteExprType(E, diag::err_incomplete_type);
12507
12508 if (auto *CO = dyn_cast<AbstractConditionalOperator>(Val: E))
12509 return CheckConditionalOperator(S, E: CO, CC, T);
12510
12511 AnalyzeImplicitConversions(S, E, CC);
12512 if (E->getType() != T)
12513 return S.CheckImplicitConversion(E, T, CC, ICContext: &ICContext);
12514}
12515
12516static void CheckConditionalOperator(Sema &S, AbstractConditionalOperator *E,
12517 SourceLocation CC, QualType T) {
12518 AnalyzeImplicitConversions(S, E: E->getCond(), CC: E->getQuestionLoc());
12519
12520 Expr *TrueExpr = E->getTrueExpr();
12521 if (auto *BCO = dyn_cast<BinaryConditionalOperator>(Val: E))
12522 TrueExpr = BCO->getCommon();
12523
12524 bool Suspicious = false;
12525 CheckConditionalOperand(S, E: TrueExpr, T, CC, ICContext&: Suspicious);
12526 CheckConditionalOperand(S, E: E->getFalseExpr(), T, CC, ICContext&: Suspicious);
12527
12528 if (T->isBooleanType())
12529 DiagnoseIntInBoolContext(S, E);
12530
12531 // If -Wconversion would have warned about either of the candidates
12532 // for a signedness conversion to the context type...
12533 if (!Suspicious) return;
12534
12535 // ...but it's currently ignored...
12536 if (!S.Diags.isIgnored(diag::warn_impcast_integer_sign_conditional, CC))
12537 return;
12538
12539 // ...then check whether it would have warned about either of the
12540 // candidates for a signedness conversion to the condition type.
12541 if (E->getType() == T) return;
12542
12543 Suspicious = false;
12544 S.CheckImplicitConversion(E: TrueExpr->IgnoreParenImpCasts(), T: E->getType(), CC,
12545 ICContext: &Suspicious);
12546 if (!Suspicious)
12547 S.CheckImplicitConversion(E: E->getFalseExpr()->IgnoreParenImpCasts(),
12548 T: E->getType(), CC, ICContext: &Suspicious);
12549}
12550
12551/// Check conversion of given expression to boolean.
12552/// Input argument E is a logical expression.
12553static void CheckBoolLikeConversion(Sema &S, Expr *E, SourceLocation CC) {
12554 // Run the bool-like conversion checks only for C since there bools are
12555 // still not used as the return type from "boolean" operators or as the input
12556 // type for conditional operators.
12557 if (S.getLangOpts().CPlusPlus)
12558 return;
12559 if (E->IgnoreParenImpCasts()->getType()->isAtomicType())
12560 return;
12561 S.CheckImplicitConversion(E: E->IgnoreParenImpCasts(), T: S.Context.BoolTy, CC);
12562}
12563
12564namespace {
12565struct AnalyzeImplicitConversionsWorkItem {
12566 Expr *E;
12567 SourceLocation CC;
12568 bool IsListInit;
12569};
12570}
12571
12572/// Data recursive variant of AnalyzeImplicitConversions. Subexpressions
12573/// that should be visited are added to WorkList.
12574static void AnalyzeImplicitConversions(
12575 Sema &S, AnalyzeImplicitConversionsWorkItem Item,
12576 llvm::SmallVectorImpl<AnalyzeImplicitConversionsWorkItem> &WorkList) {
12577 Expr *OrigE = Item.E;
12578 SourceLocation CC = Item.CC;
12579
12580 QualType T = OrigE->getType();
12581 Expr *E = OrigE->IgnoreParenImpCasts();
12582
12583 // Propagate whether we are in a C++ list initialization expression.
12584 // If so, we do not issue warnings for implicit int-float conversion
12585 // precision loss, because C++11 narrowing already handles it.
12586 //
12587 // HLSL's initialization lists are special, so they shouldn't observe the C++
12588 // behavior here.
12589 bool IsListInit =
12590 Item.IsListInit || (isa<InitListExpr>(Val: OrigE) &&
12591 S.getLangOpts().CPlusPlus && !S.getLangOpts().HLSL);
12592
12593 if (E->isTypeDependent() || E->isValueDependent())
12594 return;
12595
12596 Expr *SourceExpr = E;
12597 // Examine, but don't traverse into the source expression of an
12598 // OpaqueValueExpr, since it may have multiple parents and we don't want to
12599 // emit duplicate diagnostics. Its fine to examine the form or attempt to
12600 // evaluate it in the context of checking the specific conversion to T though.
12601 if (auto *OVE = dyn_cast<OpaqueValueExpr>(Val: E))
12602 if (auto *Src = OVE->getSourceExpr())
12603 SourceExpr = Src;
12604
12605 if (const auto *UO = dyn_cast<UnaryOperator>(SourceExpr))
12606 if (UO->getOpcode() == UO_Not &&
12607 UO->getSubExpr()->isKnownToHaveBooleanValue())
12608 S.Diag(UO->getBeginLoc(), diag::warn_bitwise_negation_bool)
12609 << OrigE->getSourceRange() << T->isBooleanType()
12610 << FixItHint::CreateReplacement(UO->getBeginLoc(), "!");
12611
12612 if (auto *BO = dyn_cast<BinaryOperator>(Val: SourceExpr)) {
12613 if ((BO->getOpcode() == BO_And || BO->getOpcode() == BO_Or) &&
12614 BO->getLHS()->isKnownToHaveBooleanValue() &&
12615 BO->getRHS()->isKnownToHaveBooleanValue() &&
12616 BO->getLHS()->HasSideEffects(Ctx: S.Context) &&
12617 BO->getRHS()->HasSideEffects(Ctx: S.Context)) {
12618 SourceManager &SM = S.getSourceManager();
12619 const LangOptions &LO = S.getLangOpts();
12620 SourceLocation BLoc = BO->getOperatorLoc();
12621 SourceLocation ELoc = Lexer::getLocForEndOfToken(Loc: BLoc, Offset: 0, SM, LangOpts: LO);
12622 StringRef SR = clang::Lexer::getSourceText(
12623 Range: clang::CharSourceRange::getTokenRange(B: BLoc, E: ELoc), SM, LangOpts: LO);
12624 // To reduce false positives, only issue the diagnostic if the operator
12625 // is explicitly spelled as a punctuator. This suppresses the diagnostic
12626 // when using 'bitand' or 'bitor' either as keywords in C++ or as macros
12627 // in C, along with other macro spellings the user might invent.
12628 if (SR.str() == "&" || SR.str() == "|") {
12629
12630 S.Diag(BO->getBeginLoc(), diag::warn_bitwise_instead_of_logical)
12631 << (BO->getOpcode() == BO_And ? "&" : "|")
12632 << OrigE->getSourceRange()
12633 << FixItHint::CreateReplacement(
12634 BO->getOperatorLoc(),
12635 (BO->getOpcode() == BO_And ? "&&" : "||"));
12636 S.Diag(BO->getBeginLoc(), diag::note_cast_operand_to_int);
12637 }
12638 } else if (BO->isCommaOp() && !S.getLangOpts().CPlusPlus) {
12639 /// Analyze the given comma operator. The basic idea behind the analysis
12640 /// is to analyze the left and right operands slightly differently. The
12641 /// left operand needs to check whether the operand itself has an implicit
12642 /// conversion, but not whether the left operand induces an implicit
12643 /// conversion for the entire comma expression itself. This is similar to
12644 /// how CheckConditionalOperand behaves; it's as-if the correct operand
12645 /// were directly used for the implicit conversion check.
12646 CheckCommaOperand(S, E: BO->getLHS(), T, CC: BO->getOperatorLoc(),
12647 /*ExtraCheckForImplicitConversion=*/false);
12648 CheckCommaOperand(S, E: BO->getRHS(), T, CC: BO->getOperatorLoc(),
12649 /*ExtraCheckForImplicitConversion=*/true);
12650 return;
12651 }
12652 }
12653
12654 // For conditional operators, we analyze the arguments as if they
12655 // were being fed directly into the output.
12656 if (auto *CO = dyn_cast<AbstractConditionalOperator>(Val: SourceExpr)) {
12657 CheckConditionalOperator(S, E: CO, CC, T);
12658 return;
12659 }
12660
12661 // Check implicit argument conversions for function calls.
12662 if (const auto *Call = dyn_cast<CallExpr>(Val: SourceExpr))
12663 CheckImplicitArgumentConversions(S, TheCall: Call, CC);
12664
12665 // Go ahead and check any implicit conversions we might have skipped.
12666 // The non-canonical typecheck is just an optimization;
12667 // CheckImplicitConversion will filter out dead implicit conversions.
12668 if (SourceExpr->getType() != T)
12669 S.CheckImplicitConversion(E: SourceExpr, T, CC, ICContext: nullptr, IsListInit);
12670
12671 // Now continue drilling into this expression.
12672
12673 if (PseudoObjectExpr *POE = dyn_cast<PseudoObjectExpr>(Val: E)) {
12674 // The bound subexpressions in a PseudoObjectExpr are not reachable
12675 // as transitive children.
12676 // FIXME: Use a more uniform representation for this.
12677 for (auto *SE : POE->semantics())
12678 if (auto *OVE = dyn_cast<OpaqueValueExpr>(Val: SE))
12679 WorkList.push_back(Elt: {.E: OVE->getSourceExpr(), .CC: CC, .IsListInit: IsListInit});
12680 }
12681
12682 // Skip past explicit casts.
12683 if (auto *CE = dyn_cast<ExplicitCastExpr>(Val: E)) {
12684 E = CE->getSubExpr()->IgnoreParenImpCasts();
12685 if (!CE->getType()->isVoidType() && E->getType()->isAtomicType())
12686 S.Diag(E->getBeginLoc(), diag::warn_atomic_implicit_seq_cst);
12687 WorkList.push_back(Elt: {.E: E, .CC: CC, .IsListInit: IsListInit});
12688 return;
12689 }
12690
12691 if (auto *OutArgE = dyn_cast<HLSLOutArgExpr>(Val: E)) {
12692 WorkList.push_back(Elt: {.E: OutArgE->getArgLValue(), .CC: CC, .IsListInit: IsListInit});
12693 // The base expression is only used to initialize the parameter for
12694 // arguments to `inout` parameters, so we only traverse down the base
12695 // expression for `inout` cases.
12696 if (OutArgE->isInOut())
12697 WorkList.push_back(
12698 Elt: {.E: OutArgE->getCastedTemporary()->getSourceExpr(), .CC: CC, .IsListInit: IsListInit});
12699 WorkList.push_back(Elt: {.E: OutArgE->getWritebackCast(), .CC: CC, .IsListInit: IsListInit});
12700 return;
12701 }
12702
12703 if (BinaryOperator *BO = dyn_cast<BinaryOperator>(Val: E)) {
12704 // Do a somewhat different check with comparison operators.
12705 if (BO->isComparisonOp())
12706 return AnalyzeComparison(S, E: BO);
12707
12708 // And with simple assignments.
12709 if (BO->getOpcode() == BO_Assign)
12710 return AnalyzeAssignment(S, E: BO);
12711 // And with compound assignments.
12712 if (BO->isAssignmentOp())
12713 return AnalyzeCompoundAssignment(S, E: BO);
12714 }
12715
12716 // These break the otherwise-useful invariant below. Fortunately,
12717 // we don't really need to recurse into them, because any internal
12718 // expressions should have been analyzed already when they were
12719 // built into statements.
12720 if (isa<StmtExpr>(Val: E)) return;
12721
12722 // Don't descend into unevaluated contexts.
12723 if (isa<UnaryExprOrTypeTraitExpr>(Val: E)) return;
12724
12725 // Now just recurse over the expression's children.
12726 CC = E->getExprLoc();
12727 BinaryOperator *BO = dyn_cast<BinaryOperator>(Val: E);
12728 bool IsLogicalAndOperator = BO && BO->getOpcode() == BO_LAnd;
12729 for (Stmt *SubStmt : E->children()) {
12730 Expr *ChildExpr = dyn_cast_or_null<Expr>(SubStmt);
12731 if (!ChildExpr)
12732 continue;
12733
12734 if (auto *CSE = dyn_cast<CoroutineSuspendExpr>(E))
12735 if (ChildExpr == CSE->getOperand())
12736 // Do not recurse over a CoroutineSuspendExpr's operand.
12737 // The operand is also a subexpression of getCommonExpr(), and
12738 // recursing into it directly would produce duplicate diagnostics.
12739 continue;
12740
12741 if (IsLogicalAndOperator &&
12742 isa<StringLiteral>(ChildExpr->IgnoreParenImpCasts()))
12743 // Ignore checking string literals that are in logical and operators.
12744 // This is a common pattern for asserts.
12745 continue;
12746 WorkList.push_back({ChildExpr, CC, IsListInit});
12747 }
12748
12749 if (BO && BO->isLogicalOp()) {
12750 Expr *SubExpr = BO->getLHS()->IgnoreParenImpCasts();
12751 if (!IsLogicalAndOperator || !isa<StringLiteral>(Val: SubExpr))
12752 ::CheckBoolLikeConversion(S, E: SubExpr, CC: BO->getExprLoc());
12753
12754 SubExpr = BO->getRHS()->IgnoreParenImpCasts();
12755 if (!IsLogicalAndOperator || !isa<StringLiteral>(Val: SubExpr))
12756 ::CheckBoolLikeConversion(S, E: SubExpr, CC: BO->getExprLoc());
12757 }
12758
12759 if (const UnaryOperator *U = dyn_cast<UnaryOperator>(Val: E)) {
12760 if (U->getOpcode() == UO_LNot) {
12761 ::CheckBoolLikeConversion(S, E: U->getSubExpr(), CC);
12762 } else if (U->getOpcode() != UO_AddrOf) {
12763 if (U->getSubExpr()->getType()->isAtomicType())
12764 S.Diag(U->getSubExpr()->getBeginLoc(),
12765 diag::warn_atomic_implicit_seq_cst);
12766 }
12767 }
12768}
12769
12770/// AnalyzeImplicitConversions - Find and report any interesting
12771/// implicit conversions in the given expression. There are a couple
12772/// of competing diagnostics here, -Wconversion and -Wsign-compare.
12773static void AnalyzeImplicitConversions(Sema &S, Expr *OrigE, SourceLocation CC,
12774 bool IsListInit/*= false*/) {
12775 llvm::SmallVector<AnalyzeImplicitConversionsWorkItem, 16> WorkList;
12776 WorkList.push_back(Elt: {.E: OrigE, .CC: CC, .IsListInit: IsListInit});
12777 while (!WorkList.empty())
12778 AnalyzeImplicitConversions(S, Item: WorkList.pop_back_val(), WorkList);
12779}
12780
12781// Helper function for Sema::DiagnoseAlwaysNonNullPointer.
12782// Returns true when emitting a warning about taking the address of a reference.
12783static bool CheckForReference(Sema &SemaRef, const Expr *E,
12784 const PartialDiagnostic &PD) {
12785 E = E->IgnoreParenImpCasts();
12786
12787 const FunctionDecl *FD = nullptr;
12788
12789 if (const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(Val: E)) {
12790 if (!DRE->getDecl()->getType()->isReferenceType())
12791 return false;
12792 } else if (const MemberExpr *M = dyn_cast<MemberExpr>(Val: E)) {
12793 if (!M->getMemberDecl()->getType()->isReferenceType())
12794 return false;
12795 } else if (const CallExpr *Call = dyn_cast<CallExpr>(Val: E)) {
12796 if (!Call->getCallReturnType(Ctx: SemaRef.Context)->isReferenceType())
12797 return false;
12798 FD = Call->getDirectCallee();
12799 } else {
12800 return false;
12801 }
12802
12803 SemaRef.Diag(E->getExprLoc(), PD);
12804
12805 // If possible, point to location of function.
12806 if (FD) {
12807 SemaRef.Diag(FD->getLocation(), diag::note_reference_is_return_value) << FD;
12808 }
12809
12810 return true;
12811}
12812
12813// Returns true if the SourceLocation is expanded from any macro body.
12814// Returns false if the SourceLocation is invalid, is from not in a macro
12815// expansion, or is from expanded from a top-level macro argument.
12816static bool IsInAnyMacroBody(const SourceManager &SM, SourceLocation Loc) {
12817 if (Loc.isInvalid())
12818 return false;
12819
12820 while (Loc.isMacroID()) {
12821 if (SM.isMacroBodyExpansion(Loc))
12822 return true;
12823 Loc = SM.getImmediateMacroCallerLoc(Loc);
12824 }
12825
12826 return false;
12827}
12828
12829void Sema::DiagnoseAlwaysNonNullPointer(Expr *E,
12830 Expr::NullPointerConstantKind NullKind,
12831 bool IsEqual, SourceRange Range) {
12832 if (!E)
12833 return;
12834
12835 // Don't warn inside macros.
12836 if (E->getExprLoc().isMacroID()) {
12837 const SourceManager &SM = getSourceManager();
12838 if (IsInAnyMacroBody(SM, Loc: E->getExprLoc()) ||
12839 IsInAnyMacroBody(SM, Loc: Range.getBegin()))
12840 return;
12841 }
12842 E = E->IgnoreImpCasts();
12843
12844 const bool IsCompare = NullKind != Expr::NPCK_NotNull;
12845
12846 if (isa<CXXThisExpr>(Val: E)) {
12847 unsigned DiagID = IsCompare ? diag::warn_this_null_compare
12848 : diag::warn_this_bool_conversion;
12849 Diag(E->getExprLoc(), DiagID) << E->getSourceRange() << Range << IsEqual;
12850 return;
12851 }
12852
12853 bool IsAddressOf = false;
12854
12855 if (auto *UO = dyn_cast<UnaryOperator>(Val: E->IgnoreParens())) {
12856 if (UO->getOpcode() != UO_AddrOf)
12857 return;
12858 IsAddressOf = true;
12859 E = UO->getSubExpr();
12860 }
12861
12862 if (IsAddressOf) {
12863 unsigned DiagID = IsCompare
12864 ? diag::warn_address_of_reference_null_compare
12865 : diag::warn_address_of_reference_bool_conversion;
12866 PartialDiagnostic PD = PDiag(DiagID) << E->getSourceRange() << Range
12867 << IsEqual;
12868 if (CheckForReference(SemaRef&: *this, E, PD)) {
12869 return;
12870 }
12871 }
12872
12873 auto ComplainAboutNonnullParamOrCall = [&](const Attr *NonnullAttr) {
12874 bool IsParam = isa<NonNullAttr>(NonnullAttr);
12875 std::string Str;
12876 llvm::raw_string_ostream S(Str);
12877 E->printPretty(S, nullptr, getPrintingPolicy());
12878 unsigned DiagID = IsCompare ? diag::warn_nonnull_expr_compare
12879 : diag::warn_cast_nonnull_to_bool;
12880 Diag(E->getExprLoc(), DiagID) << IsParam << S.str()
12881 << E->getSourceRange() << Range << IsEqual;
12882 Diag(NonnullAttr->getLocation(), diag::note_declared_nonnull) << IsParam;
12883 };
12884
12885 // If we have a CallExpr that is tagged with returns_nonnull, we can complain.
12886 if (auto *Call = dyn_cast<CallExpr>(Val: E->IgnoreParenImpCasts())) {
12887 if (auto *Callee = Call->getDirectCallee()) {
12888 if (const Attr *A = Callee->getAttr<ReturnsNonNullAttr>()) {
12889 ComplainAboutNonnullParamOrCall(A);
12890 return;
12891 }
12892 }
12893 }
12894
12895 // Complain if we are converting a lambda expression to a boolean value
12896 // outside of instantiation.
12897 if (!inTemplateInstantiation()) {
12898 if (const auto *MCallExpr = dyn_cast<CXXMemberCallExpr>(Val: E)) {
12899 if (const auto *MRecordDecl = MCallExpr->getRecordDecl();
12900 MRecordDecl && MRecordDecl->isLambda()) {
12901 Diag(E->getExprLoc(), diag::warn_impcast_pointer_to_bool)
12902 << /*LambdaPointerConversionOperatorType=*/3
12903 << MRecordDecl->getSourceRange() << Range << IsEqual;
12904 return;
12905 }
12906 }
12907 }
12908
12909 // Expect to find a single Decl. Skip anything more complicated.
12910 ValueDecl *D = nullptr;
12911 if (DeclRefExpr *R = dyn_cast<DeclRefExpr>(Val: E)) {
12912 D = R->getDecl();
12913 } else if (MemberExpr *M = dyn_cast<MemberExpr>(Val: E)) {
12914 D = M->getMemberDecl();
12915 }
12916
12917 // Weak Decls can be null.
12918 if (!D || D->isWeak())
12919 return;
12920
12921 // Check for parameter decl with nonnull attribute
12922 if (const auto* PV = dyn_cast<ParmVarDecl>(Val: D)) {
12923 if (getCurFunction() &&
12924 !getCurFunction()->ModifiedNonNullParams.count(Ptr: PV)) {
12925 if (const Attr *A = PV->getAttr<NonNullAttr>()) {
12926 ComplainAboutNonnullParamOrCall(A);
12927 return;
12928 }
12929
12930 if (const auto *FD = dyn_cast<FunctionDecl>(PV->getDeclContext())) {
12931 // Skip function template not specialized yet.
12932 if (FD->getTemplatedKind() == FunctionDecl::TK_FunctionTemplate)
12933 return;
12934 auto ParamIter = llvm::find(FD->parameters(), PV);
12935 assert(ParamIter != FD->param_end());
12936 unsigned ParamNo = std::distance(FD->param_begin(), ParamIter);
12937
12938 for (const auto *NonNull : FD->specific_attrs<NonNullAttr>()) {
12939 if (!NonNull->args_size()) {
12940 ComplainAboutNonnullParamOrCall(NonNull);
12941 return;
12942 }
12943
12944 for (const ParamIdx &ArgNo : NonNull->args()) {
12945 if (ArgNo.getASTIndex() == ParamNo) {
12946 ComplainAboutNonnullParamOrCall(NonNull);
12947 return;
12948 }
12949 }
12950 }
12951 }
12952 }
12953 }
12954
12955 QualType T = D->getType();
12956 const bool IsArray = T->isArrayType();
12957 const bool IsFunction = T->isFunctionType();
12958
12959 // Address of function is used to silence the function warning.
12960 if (IsAddressOf && IsFunction) {
12961 return;
12962 }
12963
12964 // Found nothing.
12965 if (!IsAddressOf && !IsFunction && !IsArray)
12966 return;
12967
12968 // Pretty print the expression for the diagnostic.
12969 std::string Str;
12970 llvm::raw_string_ostream S(Str);
12971 E->printPretty(S, nullptr, getPrintingPolicy());
12972
12973 unsigned DiagID = IsCompare ? diag::warn_null_pointer_compare
12974 : diag::warn_impcast_pointer_to_bool;
12975 enum {
12976 AddressOf,
12977 FunctionPointer,
12978 ArrayPointer
12979 } DiagType;
12980 if (IsAddressOf)
12981 DiagType = AddressOf;
12982 else if (IsFunction)
12983 DiagType = FunctionPointer;
12984 else if (IsArray)
12985 DiagType = ArrayPointer;
12986 else
12987 llvm_unreachable("Could not determine diagnostic.");
12988 Diag(E->getExprLoc(), DiagID) << DiagType << S.str() << E->getSourceRange()
12989 << Range << IsEqual;
12990
12991 if (!IsFunction)
12992 return;
12993
12994 // Suggest '&' to silence the function warning.
12995 Diag(E->getExprLoc(), diag::note_function_warning_silence)
12996 << FixItHint::CreateInsertion(E->getBeginLoc(), "&");
12997
12998 // Check to see if '()' fixit should be emitted.
12999 QualType ReturnType;
13000 UnresolvedSet<4> NonTemplateOverloads;
13001 tryExprAsCall(E&: *E, ZeroArgCallReturnTy&: ReturnType, NonTemplateOverloads);
13002 if (ReturnType.isNull())
13003 return;
13004
13005 if (IsCompare) {
13006 // There are two cases here. If there is null constant, the only suggest
13007 // for a pointer return type. If the null is 0, then suggest if the return
13008 // type is a pointer or an integer type.
13009 if (!ReturnType->isPointerType()) {
13010 if (NullKind == Expr::NPCK_ZeroExpression ||
13011 NullKind == Expr::NPCK_ZeroLiteral) {
13012 if (!ReturnType->isIntegerType())
13013 return;
13014 } else {
13015 return;
13016 }
13017 }
13018 } else { // !IsCompare
13019 // For function to bool, only suggest if the function pointer has bool
13020 // return type.
13021 if (!ReturnType->isSpecificBuiltinType(K: BuiltinType::Bool))
13022 return;
13023 }
13024 Diag(E->getExprLoc(), diag::note_function_to_function_call)
13025 << FixItHint::CreateInsertion(getLocForEndOfToken(E->getEndLoc()), "()");
13026}
13027
13028void Sema::CheckImplicitConversions(Expr *E, SourceLocation CC) {
13029 // Don't diagnose in unevaluated contexts.
13030 if (isUnevaluatedContext())
13031 return;
13032
13033 // Don't diagnose for value- or type-dependent expressions.
13034 if (E->isTypeDependent() || E->isValueDependent())
13035 return;
13036
13037 // Check for array bounds violations in cases where the check isn't triggered
13038 // elsewhere for other Expr types (like BinaryOperators), e.g. when an
13039 // ArraySubscriptExpr is on the RHS of a variable initialization.
13040 CheckArrayAccess(E);
13041
13042 // This is not the right CC for (e.g.) a variable initialization.
13043 AnalyzeImplicitConversions(S&: *this, OrigE: E, CC);
13044}
13045
13046void Sema::CheckBoolLikeConversion(Expr *E, SourceLocation CC) {
13047 ::CheckBoolLikeConversion(S&: *this, E, CC);
13048}
13049
13050void Sema::CheckForIntOverflow (const Expr *E) {
13051 // Use a work list to deal with nested struct initializers.
13052 SmallVector<const Expr *, 2> Exprs(1, E);
13053
13054 do {
13055 const Expr *OriginalE = Exprs.pop_back_val();
13056 const Expr *E = OriginalE->IgnoreParenCasts();
13057
13058 if (isa<BinaryOperator, UnaryOperator>(Val: E)) {
13059 E->EvaluateForOverflow(Ctx: Context);
13060 continue;
13061 }
13062
13063 if (const auto *InitList = dyn_cast<InitListExpr>(Val: OriginalE))
13064 Exprs.append(in_start: InitList->inits().begin(), in_end: InitList->inits().end());
13065 else if (isa<ObjCBoxedExpr>(Val: OriginalE))
13066 E->EvaluateForOverflow(Ctx: Context);
13067 else if (const auto *Call = dyn_cast<CallExpr>(Val: E))
13068 Exprs.append(in_start: Call->arg_begin(), in_end: Call->arg_end());
13069 else if (const auto *Message = dyn_cast<ObjCMessageExpr>(Val: E))
13070 Exprs.append(Message->arg_begin(), Message->arg_end());
13071 else if (const auto *Construct = dyn_cast<CXXConstructExpr>(Val: E))
13072 Exprs.append(Construct->arg_begin(), Construct->arg_end());
13073 else if (const auto *Temporary = dyn_cast<CXXBindTemporaryExpr>(Val: E))
13074 Exprs.push_back(Elt: Temporary->getSubExpr());
13075 else if (const auto *Array = dyn_cast<ArraySubscriptExpr>(Val: E))
13076 Exprs.push_back(Elt: Array->getIdx());
13077 else if (const auto *Compound = dyn_cast<CompoundLiteralExpr>(Val: E))
13078 Exprs.push_back(Elt: Compound->getInitializer());
13079 else if (const auto *New = dyn_cast<CXXNewExpr>(Val: E);
13080 New && New->isArray()) {
13081 if (auto ArraySize = New->getArraySize())
13082 Exprs.push_back(Elt: *ArraySize);
13083 } else if (const auto *MTE = dyn_cast<MaterializeTemporaryExpr>(Val: OriginalE))
13084 Exprs.push_back(Elt: MTE->getSubExpr());
13085 } while (!Exprs.empty());
13086}
13087
13088namespace {
13089
13090/// Visitor for expressions which looks for unsequenced operations on the
13091/// same object.
13092class SequenceChecker : public ConstEvaluatedExprVisitor<SequenceChecker> {
13093 using Base = ConstEvaluatedExprVisitor<SequenceChecker>;
13094
13095 /// A tree of sequenced regions within an expression. Two regions are
13096 /// unsequenced if one is an ancestor or a descendent of the other. When we
13097 /// finish processing an expression with sequencing, such as a comma
13098 /// expression, we fold its tree nodes into its parent, since they are
13099 /// unsequenced with respect to nodes we will visit later.
13100 class SequenceTree {
13101 struct Value {
13102 explicit Value(unsigned Parent) : Parent(Parent), Merged(false) {}
13103 unsigned Parent : 31;
13104 LLVM_PREFERRED_TYPE(bool)
13105 unsigned Merged : 1;
13106 };
13107 SmallVector<Value, 8> Values;
13108
13109 public:
13110 /// A region within an expression which may be sequenced with respect
13111 /// to some other region.
13112 class Seq {
13113 friend class SequenceTree;
13114
13115 unsigned Index;
13116
13117 explicit Seq(unsigned N) : Index(N) {}
13118
13119 public:
13120 Seq() : Index(0) {}
13121 };
13122
13123 SequenceTree() { Values.push_back(Elt: Value(0)); }
13124 Seq root() const { return Seq(0); }
13125
13126 /// Create a new sequence of operations, which is an unsequenced
13127 /// subset of \p Parent. This sequence of operations is sequenced with
13128 /// respect to other children of \p Parent.
13129 Seq allocate(Seq Parent) {
13130 Values.push_back(Elt: Value(Parent.Index));
13131 return Seq(Values.size() - 1);
13132 }
13133
13134 /// Merge a sequence of operations into its parent.
13135 void merge(Seq S) {
13136 Values[S.Index].Merged = true;
13137 }
13138
13139 /// Determine whether two operations are unsequenced. This operation
13140 /// is asymmetric: \p Cur should be the more recent sequence, and \p Old
13141 /// should have been merged into its parent as appropriate.
13142 bool isUnsequenced(Seq Cur, Seq Old) {
13143 unsigned C = representative(K: Cur.Index);
13144 unsigned Target = representative(K: Old.Index);
13145 while (C >= Target) {
13146 if (C == Target)
13147 return true;
13148 C = Values[C].Parent;
13149 }
13150 return false;
13151 }
13152
13153 private:
13154 /// Pick a representative for a sequence.
13155 unsigned representative(unsigned K) {
13156 if (Values[K].Merged)
13157 // Perform path compression as we go.
13158 return Values[K].Parent = representative(K: Values[K].Parent);
13159 return K;
13160 }
13161 };
13162
13163 /// An object for which we can track unsequenced uses.
13164 using Object = const NamedDecl *;
13165
13166 /// Different flavors of object usage which we track. We only track the
13167 /// least-sequenced usage of each kind.
13168 enum UsageKind {
13169 /// A read of an object. Multiple unsequenced reads are OK.
13170 UK_Use,
13171
13172 /// A modification of an object which is sequenced before the value
13173 /// computation of the expression, such as ++n in C++.
13174 UK_ModAsValue,
13175
13176 /// A modification of an object which is not sequenced before the value
13177 /// computation of the expression, such as n++.
13178 UK_ModAsSideEffect,
13179
13180 UK_Count = UK_ModAsSideEffect + 1
13181 };
13182
13183 /// Bundle together a sequencing region and the expression corresponding
13184 /// to a specific usage. One Usage is stored for each usage kind in UsageInfo.
13185 struct Usage {
13186 const Expr *UsageExpr = nullptr;
13187 SequenceTree::Seq Seq;
13188
13189 Usage() = default;
13190 };
13191
13192 struct UsageInfo {
13193 Usage Uses[UK_Count];
13194
13195 /// Have we issued a diagnostic for this object already?
13196 bool Diagnosed = false;
13197
13198 UsageInfo();
13199 };
13200 using UsageInfoMap = llvm::SmallDenseMap<Object, UsageInfo, 16>;
13201
13202 Sema &SemaRef;
13203
13204 /// Sequenced regions within the expression.
13205 SequenceTree Tree;
13206
13207 /// Declaration modifications and references which we have seen.
13208 UsageInfoMap UsageMap;
13209
13210 /// The region we are currently within.
13211 SequenceTree::Seq Region;
13212
13213 /// Filled in with declarations which were modified as a side-effect
13214 /// (that is, post-increment operations).
13215 SmallVectorImpl<std::pair<Object, Usage>> *ModAsSideEffect = nullptr;
13216
13217 /// Expressions to check later. We defer checking these to reduce
13218 /// stack usage.
13219 SmallVectorImpl<const Expr *> &WorkList;
13220
13221 /// RAII object wrapping the visitation of a sequenced subexpression of an
13222 /// expression. At the end of this process, the side-effects of the evaluation
13223 /// become sequenced with respect to the value computation of the result, so
13224 /// we downgrade any UK_ModAsSideEffect within the evaluation to
13225 /// UK_ModAsValue.
13226 struct SequencedSubexpression {
13227 SequencedSubexpression(SequenceChecker &Self)
13228 : Self(Self), OldModAsSideEffect(Self.ModAsSideEffect) {
13229 Self.ModAsSideEffect = &ModAsSideEffect;
13230 }
13231
13232 ~SequencedSubexpression() {
13233 for (const std::pair<Object, Usage> &M : llvm::reverse(C&: ModAsSideEffect)) {
13234 // Add a new usage with usage kind UK_ModAsValue, and then restore
13235 // the previous usage with UK_ModAsSideEffect (thus clearing it if
13236 // the previous one was empty).
13237 UsageInfo &UI = Self.UsageMap[M.first];
13238 auto &SideEffectUsage = UI.Uses[UK_ModAsSideEffect];
13239 Self.addUsage(O: M.first, UI, UsageExpr: SideEffectUsage.UsageExpr, UK: UK_ModAsValue);
13240 SideEffectUsage = M.second;
13241 }
13242 Self.ModAsSideEffect = OldModAsSideEffect;
13243 }
13244
13245 SequenceChecker &Self;
13246 SmallVector<std::pair<Object, Usage>, 4> ModAsSideEffect;
13247 SmallVectorImpl<std::pair<Object, Usage>> *OldModAsSideEffect;
13248 };
13249
13250 /// RAII object wrapping the visitation of a subexpression which we might
13251 /// choose to evaluate as a constant. If any subexpression is evaluated and
13252 /// found to be non-constant, this allows us to suppress the evaluation of
13253 /// the outer expression.
13254 class EvaluationTracker {
13255 public:
13256 EvaluationTracker(SequenceChecker &Self)
13257 : Self(Self), Prev(Self.EvalTracker) {
13258 Self.EvalTracker = this;
13259 }
13260
13261 ~EvaluationTracker() {
13262 Self.EvalTracker = Prev;
13263 if (Prev)
13264 Prev->EvalOK &= EvalOK;
13265 }
13266
13267 bool evaluate(const Expr *E, bool &Result) {
13268 if (!EvalOK || E->isValueDependent())
13269 return false;
13270 EvalOK = E->EvaluateAsBooleanCondition(
13271 Result, Ctx: Self.SemaRef.Context,
13272 InConstantContext: Self.SemaRef.isConstantEvaluatedContext());
13273 return EvalOK;
13274 }
13275
13276 private:
13277 SequenceChecker &Self;
13278 EvaluationTracker *Prev;
13279 bool EvalOK = true;
13280 } *EvalTracker = nullptr;
13281
13282 /// Find the object which is produced by the specified expression,
13283 /// if any.
13284 Object getObject(const Expr *E, bool Mod) const {
13285 E = E->IgnoreParenCasts();
13286 if (const UnaryOperator *UO = dyn_cast<UnaryOperator>(Val: E)) {
13287 if (Mod && (UO->getOpcode() == UO_PreInc || UO->getOpcode() == UO_PreDec))
13288 return getObject(E: UO->getSubExpr(), Mod);
13289 } else if (const BinaryOperator *BO = dyn_cast<BinaryOperator>(Val: E)) {
13290 if (BO->getOpcode() == BO_Comma)
13291 return getObject(E: BO->getRHS(), Mod);
13292 if (Mod && BO->isAssignmentOp())
13293 return getObject(E: BO->getLHS(), Mod);
13294 } else if (const MemberExpr *ME = dyn_cast<MemberExpr>(Val: E)) {
13295 // FIXME: Check for more interesting cases, like "x.n = ++x.n".
13296 if (isa<CXXThisExpr>(Val: ME->getBase()->IgnoreParenCasts()))
13297 return ME->getMemberDecl();
13298 } else if (const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(Val: E))
13299 // FIXME: If this is a reference, map through to its value.
13300 return DRE->getDecl();
13301 return nullptr;
13302 }
13303
13304 /// Note that an object \p O was modified or used by an expression
13305 /// \p UsageExpr with usage kind \p UK. \p UI is the \p UsageInfo for
13306 /// the object \p O as obtained via the \p UsageMap.
13307 void addUsage(Object O, UsageInfo &UI, const Expr *UsageExpr, UsageKind UK) {
13308 // Get the old usage for the given object and usage kind.
13309 Usage &U = UI.Uses[UK];
13310 if (!U.UsageExpr || !Tree.isUnsequenced(Cur: Region, Old: U.Seq)) {
13311 // If we have a modification as side effect and are in a sequenced
13312 // subexpression, save the old Usage so that we can restore it later
13313 // in SequencedSubexpression::~SequencedSubexpression.
13314 if (UK == UK_ModAsSideEffect && ModAsSideEffect)
13315 ModAsSideEffect->push_back(Elt: std::make_pair(x&: O, y&: U));
13316 // Then record the new usage with the current sequencing region.
13317 U.UsageExpr = UsageExpr;
13318 U.Seq = Region;
13319 }
13320 }
13321
13322 /// Check whether a modification or use of an object \p O in an expression
13323 /// \p UsageExpr conflicts with a prior usage of kind \p OtherKind. \p UI is
13324 /// the \p UsageInfo for the object \p O as obtained via the \p UsageMap.
13325 /// \p IsModMod is true when we are checking for a mod-mod unsequenced
13326 /// usage and false we are checking for a mod-use unsequenced usage.
13327 void checkUsage(Object O, UsageInfo &UI, const Expr *UsageExpr,
13328 UsageKind OtherKind, bool IsModMod) {
13329 if (UI.Diagnosed)
13330 return;
13331
13332 const Usage &U = UI.Uses[OtherKind];
13333 if (!U.UsageExpr || !Tree.isUnsequenced(Cur: Region, Old: U.Seq))
13334 return;
13335
13336 const Expr *Mod = U.UsageExpr;
13337 const Expr *ModOrUse = UsageExpr;
13338 if (OtherKind == UK_Use)
13339 std::swap(a&: Mod, b&: ModOrUse);
13340
13341 SemaRef.DiagRuntimeBehavior(
13342 Mod->getExprLoc(), {Mod, ModOrUse},
13343 SemaRef.PDiag(IsModMod ? diag::warn_unsequenced_mod_mod
13344 : diag::warn_unsequenced_mod_use)
13345 << O << SourceRange(ModOrUse->getExprLoc()));
13346 UI.Diagnosed = true;
13347 }
13348
13349 // A note on note{Pre, Post}{Use, Mod}:
13350 //
13351 // (It helps to follow the algorithm with an expression such as
13352 // "((++k)++, k) = k" or "k = (k++, k++)". Both contain unsequenced
13353 // operations before C++17 and both are well-defined in C++17).
13354 //
13355 // When visiting a node which uses/modify an object we first call notePreUse
13356 // or notePreMod before visiting its sub-expression(s). At this point the
13357 // children of the current node have not yet been visited and so the eventual
13358 // uses/modifications resulting from the children of the current node have not
13359 // been recorded yet.
13360 //
13361 // We then visit the children of the current node. After that notePostUse or
13362 // notePostMod is called. These will 1) detect an unsequenced modification
13363 // as side effect (as in "k++ + k") and 2) add a new usage with the
13364 // appropriate usage kind.
13365 //
13366 // We also have to be careful that some operation sequences modification as
13367 // side effect as well (for example: || or ,). To account for this we wrap
13368 // the visitation of such a sub-expression (for example: the LHS of || or ,)
13369 // with SequencedSubexpression. SequencedSubexpression is an RAII object
13370 // which record usages which are modifications as side effect, and then
13371 // downgrade them (or more accurately restore the previous usage which was a
13372 // modification as side effect) when exiting the scope of the sequenced
13373 // subexpression.
13374
13375 void notePreUse(Object O, const Expr *UseExpr) {
13376 UsageInfo &UI = UsageMap[O];
13377 // Uses conflict with other modifications.
13378 checkUsage(O, UI, UsageExpr: UseExpr, /*OtherKind=*/UK_ModAsValue, /*IsModMod=*/false);
13379 }
13380
13381 void notePostUse(Object O, const Expr *UseExpr) {
13382 UsageInfo &UI = UsageMap[O];
13383 checkUsage(O, UI, UsageExpr: UseExpr, /*OtherKind=*/UK_ModAsSideEffect,
13384 /*IsModMod=*/false);
13385 addUsage(O, UI, UsageExpr: UseExpr, /*UsageKind=*/UK: UK_Use);
13386 }
13387
13388 void notePreMod(Object O, const Expr *ModExpr) {
13389 UsageInfo &UI = UsageMap[O];
13390 // Modifications conflict with other modifications and with uses.
13391 checkUsage(O, UI, UsageExpr: ModExpr, /*OtherKind=*/UK_ModAsValue, /*IsModMod=*/true);
13392 checkUsage(O, UI, UsageExpr: ModExpr, /*OtherKind=*/UK_Use, /*IsModMod=*/false);
13393 }
13394
13395 void notePostMod(Object O, const Expr *ModExpr, UsageKind UK) {
13396 UsageInfo &UI = UsageMap[O];
13397 checkUsage(O, UI, UsageExpr: ModExpr, /*OtherKind=*/UK_ModAsSideEffect,
13398 /*IsModMod=*/true);
13399 addUsage(O, UI, UsageExpr: ModExpr, /*UsageKind=*/UK);
13400 }
13401
13402public:
13403 SequenceChecker(Sema &S, const Expr *E,
13404 SmallVectorImpl<const Expr *> &WorkList)
13405 : Base(S.Context), SemaRef(S), Region(Tree.root()), WorkList(WorkList) {
13406 Visit(E);
13407 // Silence a -Wunused-private-field since WorkList is now unused.
13408 // TODO: Evaluate if it can be used, and if not remove it.
13409 (void)this->WorkList;
13410 }
13411
13412 void VisitStmt(const Stmt *S) {
13413 // Skip all statements which aren't expressions for now.
13414 }
13415
13416 void VisitExpr(const Expr *E) {
13417 // By default, just recurse to evaluated subexpressions.
13418 Base::VisitStmt(E);
13419 }
13420
13421 void VisitCoroutineSuspendExpr(const CoroutineSuspendExpr *CSE) {
13422 for (auto *Sub : CSE->children()) {
13423 const Expr *ChildExpr = dyn_cast_or_null<Expr>(Val: Sub);
13424 if (!ChildExpr)
13425 continue;
13426
13427 if (ChildExpr == CSE->getOperand())
13428 // Do not recurse over a CoroutineSuspendExpr's operand.
13429 // The operand is also a subexpression of getCommonExpr(), and
13430 // recursing into it directly could confuse object management
13431 // for the sake of sequence tracking.
13432 continue;
13433
13434 Visit(S: Sub);
13435 }
13436 }
13437
13438 void VisitCastExpr(const CastExpr *E) {
13439 Object O = Object();
13440 if (E->getCastKind() == CK_LValueToRValue)
13441 O = getObject(E: E->getSubExpr(), Mod: false);
13442
13443 if (O)
13444 notePreUse(O, E);
13445 VisitExpr(E);
13446 if (O)
13447 notePostUse(O, E);
13448 }
13449
13450 void VisitSequencedExpressions(const Expr *SequencedBefore,
13451 const Expr *SequencedAfter) {
13452 SequenceTree::Seq BeforeRegion = Tree.allocate(Parent: Region);
13453 SequenceTree::Seq AfterRegion = Tree.allocate(Parent: Region);
13454 SequenceTree::Seq OldRegion = Region;
13455
13456 {
13457 SequencedSubexpression SeqBefore(*this);
13458 Region = BeforeRegion;
13459 Visit(SequencedBefore);
13460 }
13461
13462 Region = AfterRegion;
13463 Visit(SequencedAfter);
13464
13465 Region = OldRegion;
13466
13467 Tree.merge(S: BeforeRegion);
13468 Tree.merge(S: AfterRegion);
13469 }
13470
13471 void VisitArraySubscriptExpr(const ArraySubscriptExpr *ASE) {
13472 // C++17 [expr.sub]p1:
13473 // The expression E1[E2] is identical (by definition) to *((E1)+(E2)). The
13474 // expression E1 is sequenced before the expression E2.
13475 if (SemaRef.getLangOpts().CPlusPlus17)
13476 VisitSequencedExpressions(SequencedBefore: ASE->getLHS(), SequencedAfter: ASE->getRHS());
13477 else {
13478 Visit(ASE->getLHS());
13479 Visit(ASE->getRHS());
13480 }
13481 }
13482
13483 void VisitBinPtrMemD(const BinaryOperator *BO) { VisitBinPtrMem(BO); }
13484 void VisitBinPtrMemI(const BinaryOperator *BO) { VisitBinPtrMem(BO); }
13485 void VisitBinPtrMem(const BinaryOperator *BO) {
13486 // C++17 [expr.mptr.oper]p4:
13487 // Abbreviating pm-expression.*cast-expression as E1.*E2, [...]
13488 // the expression E1 is sequenced before the expression E2.
13489 if (SemaRef.getLangOpts().CPlusPlus17)
13490 VisitSequencedExpressions(SequencedBefore: BO->getLHS(), SequencedAfter: BO->getRHS());
13491 else {
13492 Visit(BO->getLHS());
13493 Visit(BO->getRHS());
13494 }
13495 }
13496
13497 void VisitBinShl(const BinaryOperator *BO) { VisitBinShlShr(BO); }
13498 void VisitBinShr(const BinaryOperator *BO) { VisitBinShlShr(BO); }
13499 void VisitBinShlShr(const BinaryOperator *BO) {
13500 // C++17 [expr.shift]p4:
13501 // The expression E1 is sequenced before the expression E2.
13502 if (SemaRef.getLangOpts().CPlusPlus17)
13503 VisitSequencedExpressions(SequencedBefore: BO->getLHS(), SequencedAfter: BO->getRHS());
13504 else {
13505 Visit(BO->getLHS());
13506 Visit(BO->getRHS());
13507 }
13508 }
13509
13510 void VisitBinComma(const BinaryOperator *BO) {
13511 // C++11 [expr.comma]p1:
13512 // Every value computation and side effect associated with the left
13513 // expression is sequenced before every value computation and side
13514 // effect associated with the right expression.
13515 VisitSequencedExpressions(SequencedBefore: BO->getLHS(), SequencedAfter: BO->getRHS());
13516 }
13517
13518 void VisitBinAssign(const BinaryOperator *BO) {
13519 SequenceTree::Seq RHSRegion;
13520 SequenceTree::Seq LHSRegion;
13521 if (SemaRef.getLangOpts().CPlusPlus17) {
13522 RHSRegion = Tree.allocate(Parent: Region);
13523 LHSRegion = Tree.allocate(Parent: Region);
13524 } else {
13525 RHSRegion = Region;
13526 LHSRegion = Region;
13527 }
13528 SequenceTree::Seq OldRegion = Region;
13529
13530 // C++11 [expr.ass]p1:
13531 // [...] the assignment is sequenced after the value computation
13532 // of the right and left operands, [...]
13533 //
13534 // so check it before inspecting the operands and update the
13535 // map afterwards.
13536 Object O = getObject(E: BO->getLHS(), /*Mod=*/true);
13537 if (O)
13538 notePreMod(O, BO);
13539
13540 if (SemaRef.getLangOpts().CPlusPlus17) {
13541 // C++17 [expr.ass]p1:
13542 // [...] The right operand is sequenced before the left operand. [...]
13543 {
13544 SequencedSubexpression SeqBefore(*this);
13545 Region = RHSRegion;
13546 Visit(BO->getRHS());
13547 }
13548
13549 Region = LHSRegion;
13550 Visit(BO->getLHS());
13551
13552 if (O && isa<CompoundAssignOperator>(Val: BO))
13553 notePostUse(O, BO);
13554
13555 } else {
13556 // C++11 does not specify any sequencing between the LHS and RHS.
13557 Region = LHSRegion;
13558 Visit(BO->getLHS());
13559
13560 if (O && isa<CompoundAssignOperator>(Val: BO))
13561 notePostUse(O, BO);
13562
13563 Region = RHSRegion;
13564 Visit(BO->getRHS());
13565 }
13566
13567 // C++11 [expr.ass]p1:
13568 // the assignment is sequenced [...] before the value computation of the
13569 // assignment expression.
13570 // C11 6.5.16/3 has no such rule.
13571 Region = OldRegion;
13572 if (O)
13573 notePostMod(O, BO,
13574 SemaRef.getLangOpts().CPlusPlus ? UK_ModAsValue
13575 : UK_ModAsSideEffect);
13576 if (SemaRef.getLangOpts().CPlusPlus17) {
13577 Tree.merge(S: RHSRegion);
13578 Tree.merge(S: LHSRegion);
13579 }
13580 }
13581
13582 void VisitCompoundAssignOperator(const CompoundAssignOperator *CAO) {
13583 VisitBinAssign(CAO);
13584 }
13585
13586 void VisitUnaryPreInc(const UnaryOperator *UO) { VisitUnaryPreIncDec(UO); }
13587 void VisitUnaryPreDec(const UnaryOperator *UO) { VisitUnaryPreIncDec(UO); }
13588 void VisitUnaryPreIncDec(const UnaryOperator *UO) {
13589 Object O = getObject(E: UO->getSubExpr(), Mod: true);
13590 if (!O)
13591 return VisitExpr(UO);
13592
13593 notePreMod(O, UO);
13594 Visit(UO->getSubExpr());
13595 // C++11 [expr.pre.incr]p1:
13596 // the expression ++x is equivalent to x+=1
13597 notePostMod(O, UO,
13598 SemaRef.getLangOpts().CPlusPlus ? UK_ModAsValue
13599 : UK_ModAsSideEffect);
13600 }
13601
13602 void VisitUnaryPostInc(const UnaryOperator *UO) { VisitUnaryPostIncDec(UO); }
13603 void VisitUnaryPostDec(const UnaryOperator *UO) { VisitUnaryPostIncDec(UO); }
13604 void VisitUnaryPostIncDec(const UnaryOperator *UO) {
13605 Object O = getObject(E: UO->getSubExpr(), Mod: true);
13606 if (!O)
13607 return VisitExpr(UO);
13608
13609 notePreMod(O, UO);
13610 Visit(UO->getSubExpr());
13611 notePostMod(O, UO, UK_ModAsSideEffect);
13612 }
13613
13614 void VisitBinLOr(const BinaryOperator *BO) {
13615 // C++11 [expr.log.or]p2:
13616 // If the second expression is evaluated, every value computation and
13617 // side effect associated with the first expression is sequenced before
13618 // every value computation and side effect associated with the
13619 // second expression.
13620 SequenceTree::Seq LHSRegion = Tree.allocate(Parent: Region);
13621 SequenceTree::Seq RHSRegion = Tree.allocate(Parent: Region);
13622 SequenceTree::Seq OldRegion = Region;
13623
13624 EvaluationTracker Eval(*this);
13625 {
13626 SequencedSubexpression Sequenced(*this);
13627 Region = LHSRegion;
13628 Visit(BO->getLHS());
13629 }
13630
13631 // C++11 [expr.log.or]p1:
13632 // [...] the second operand is not evaluated if the first operand
13633 // evaluates to true.
13634 bool EvalResult = false;
13635 bool EvalOK = Eval.evaluate(E: BO->getLHS(), Result&: EvalResult);
13636 bool ShouldVisitRHS = !EvalOK || !EvalResult;
13637 if (ShouldVisitRHS) {
13638 Region = RHSRegion;
13639 Visit(BO->getRHS());
13640 }
13641
13642 Region = OldRegion;
13643 Tree.merge(S: LHSRegion);
13644 Tree.merge(S: RHSRegion);
13645 }
13646
13647 void VisitBinLAnd(const BinaryOperator *BO) {
13648 // C++11 [expr.log.and]p2:
13649 // If the second expression is evaluated, every value computation and
13650 // side effect associated with the first expression is sequenced before
13651 // every value computation and side effect associated with the
13652 // second expression.
13653 SequenceTree::Seq LHSRegion = Tree.allocate(Parent: Region);
13654 SequenceTree::Seq RHSRegion = Tree.allocate(Parent: Region);
13655 SequenceTree::Seq OldRegion = Region;
13656
13657 EvaluationTracker Eval(*this);
13658 {
13659 SequencedSubexpression Sequenced(*this);
13660 Region = LHSRegion;
13661 Visit(BO->getLHS());
13662 }
13663
13664 // C++11 [expr.log.and]p1:
13665 // [...] the second operand is not evaluated if the first operand is false.
13666 bool EvalResult = false;
13667 bool EvalOK = Eval.evaluate(E: BO->getLHS(), Result&: EvalResult);
13668 bool ShouldVisitRHS = !EvalOK || EvalResult;
13669 if (ShouldVisitRHS) {
13670 Region = RHSRegion;
13671 Visit(BO->getRHS());
13672 }
13673
13674 Region = OldRegion;
13675 Tree.merge(S: LHSRegion);
13676 Tree.merge(S: RHSRegion);
13677 }
13678
13679 void VisitAbstractConditionalOperator(const AbstractConditionalOperator *CO) {
13680 // C++11 [expr.cond]p1:
13681 // [...] Every value computation and side effect associated with the first
13682 // expression is sequenced before every value computation and side effect
13683 // associated with the second or third expression.
13684 SequenceTree::Seq ConditionRegion = Tree.allocate(Parent: Region);
13685
13686 // No sequencing is specified between the true and false expression.
13687 // However since exactly one of both is going to be evaluated we can
13688 // consider them to be sequenced. This is needed to avoid warning on
13689 // something like "x ? y+= 1 : y += 2;" in the case where we will visit
13690 // both the true and false expressions because we can't evaluate x.
13691 // This will still allow us to detect an expression like (pre C++17)
13692 // "(x ? y += 1 : y += 2) = y".
13693 //
13694 // We don't wrap the visitation of the true and false expression with
13695 // SequencedSubexpression because we don't want to downgrade modifications
13696 // as side effect in the true and false expressions after the visition
13697 // is done. (for example in the expression "(x ? y++ : y++) + y" we should
13698 // not warn between the two "y++", but we should warn between the "y++"
13699 // and the "y".
13700 SequenceTree::Seq TrueRegion = Tree.allocate(Parent: Region);
13701 SequenceTree::Seq FalseRegion = Tree.allocate(Parent: Region);
13702 SequenceTree::Seq OldRegion = Region;
13703
13704 EvaluationTracker Eval(*this);
13705 {
13706 SequencedSubexpression Sequenced(*this);
13707 Region = ConditionRegion;
13708 Visit(CO->getCond());
13709 }
13710
13711 // C++11 [expr.cond]p1:
13712 // [...] The first expression is contextually converted to bool (Clause 4).
13713 // It is evaluated and if it is true, the result of the conditional
13714 // expression is the value of the second expression, otherwise that of the
13715 // third expression. Only one of the second and third expressions is
13716 // evaluated. [...]
13717 bool EvalResult = false;
13718 bool EvalOK = Eval.evaluate(E: CO->getCond(), Result&: EvalResult);
13719 bool ShouldVisitTrueExpr = !EvalOK || EvalResult;
13720 bool ShouldVisitFalseExpr = !EvalOK || !EvalResult;
13721 if (ShouldVisitTrueExpr) {
13722 Region = TrueRegion;
13723 Visit(CO->getTrueExpr());
13724 }
13725 if (ShouldVisitFalseExpr) {
13726 Region = FalseRegion;
13727 Visit(CO->getFalseExpr());
13728 }
13729
13730 Region = OldRegion;
13731 Tree.merge(S: ConditionRegion);
13732 Tree.merge(S: TrueRegion);
13733 Tree.merge(S: FalseRegion);
13734 }
13735
13736 void VisitCallExpr(const CallExpr *CE) {
13737 // FIXME: CXXNewExpr and CXXDeleteExpr implicitly call functions.
13738
13739 if (CE->isUnevaluatedBuiltinCall(Ctx: Context))
13740 return;
13741
13742 // C++11 [intro.execution]p15:
13743 // When calling a function [...], every value computation and side effect
13744 // associated with any argument expression, or with the postfix expression
13745 // designating the called function, is sequenced before execution of every
13746 // expression or statement in the body of the function [and thus before
13747 // the value computation of its result].
13748 SequencedSubexpression Sequenced(*this);
13749 SemaRef.runWithSufficientStackSpace(Loc: CE->getExprLoc(), Fn: [&] {
13750 // C++17 [expr.call]p5
13751 // The postfix-expression is sequenced before each expression in the
13752 // expression-list and any default argument. [...]
13753 SequenceTree::Seq CalleeRegion;
13754 SequenceTree::Seq OtherRegion;
13755 if (SemaRef.getLangOpts().CPlusPlus17) {
13756 CalleeRegion = Tree.allocate(Parent: Region);
13757 OtherRegion = Tree.allocate(Parent: Region);
13758 } else {
13759 CalleeRegion = Region;
13760 OtherRegion = Region;
13761 }
13762 SequenceTree::Seq OldRegion = Region;
13763
13764 // Visit the callee expression first.
13765 Region = CalleeRegion;
13766 if (SemaRef.getLangOpts().CPlusPlus17) {
13767 SequencedSubexpression Sequenced(*this);
13768 Visit(CE->getCallee());
13769 } else {
13770 Visit(CE->getCallee());
13771 }
13772
13773 // Then visit the argument expressions.
13774 Region = OtherRegion;
13775 for (const Expr *Argument : CE->arguments())
13776 Visit(Argument);
13777
13778 Region = OldRegion;
13779 if (SemaRef.getLangOpts().CPlusPlus17) {
13780 Tree.merge(S: CalleeRegion);
13781 Tree.merge(S: OtherRegion);
13782 }
13783 });
13784 }
13785
13786 void VisitCXXOperatorCallExpr(const CXXOperatorCallExpr *CXXOCE) {
13787 // C++17 [over.match.oper]p2:
13788 // [...] the operator notation is first transformed to the equivalent
13789 // function-call notation as summarized in Table 12 (where @ denotes one
13790 // of the operators covered in the specified subclause). However, the
13791 // operands are sequenced in the order prescribed for the built-in
13792 // operator (Clause 8).
13793 //
13794 // From the above only overloaded binary operators and overloaded call
13795 // operators have sequencing rules in C++17 that we need to handle
13796 // separately.
13797 if (!SemaRef.getLangOpts().CPlusPlus17 ||
13798 (CXXOCE->getNumArgs() != 2 && CXXOCE->getOperator() != OO_Call))
13799 return VisitCallExpr(CXXOCE);
13800
13801 enum {
13802 NoSequencing,
13803 LHSBeforeRHS,
13804 RHSBeforeLHS,
13805 LHSBeforeRest
13806 } SequencingKind;
13807 switch (CXXOCE->getOperator()) {
13808 case OO_Equal:
13809 case OO_PlusEqual:
13810 case OO_MinusEqual:
13811 case OO_StarEqual:
13812 case OO_SlashEqual:
13813 case OO_PercentEqual:
13814 case OO_CaretEqual:
13815 case OO_AmpEqual:
13816 case OO_PipeEqual:
13817 case OO_LessLessEqual:
13818 case OO_GreaterGreaterEqual:
13819 SequencingKind = RHSBeforeLHS;
13820 break;
13821
13822 case OO_LessLess:
13823 case OO_GreaterGreater:
13824 case OO_AmpAmp:
13825 case OO_PipePipe:
13826 case OO_Comma:
13827 case OO_ArrowStar:
13828 case OO_Subscript:
13829 SequencingKind = LHSBeforeRHS;
13830 break;
13831
13832 case OO_Call:
13833 SequencingKind = LHSBeforeRest;
13834 break;
13835
13836 default:
13837 SequencingKind = NoSequencing;
13838 break;
13839 }
13840
13841 if (SequencingKind == NoSequencing)
13842 return VisitCallExpr(CXXOCE);
13843
13844 // This is a call, so all subexpressions are sequenced before the result.
13845 SequencedSubexpression Sequenced(*this);
13846
13847 SemaRef.runWithSufficientStackSpace(CXXOCE->getExprLoc(), [&] {
13848 assert(SemaRef.getLangOpts().CPlusPlus17 &&
13849 "Should only get there with C++17 and above!");
13850 assert((CXXOCE->getNumArgs() == 2 || CXXOCE->getOperator() == OO_Call) &&
13851 "Should only get there with an overloaded binary operator"
13852 " or an overloaded call operator!");
13853
13854 if (SequencingKind == LHSBeforeRest) {
13855 assert(CXXOCE->getOperator() == OO_Call &&
13856 "We should only have an overloaded call operator here!");
13857
13858 // This is very similar to VisitCallExpr, except that we only have the
13859 // C++17 case. The postfix-expression is the first argument of the
13860 // CXXOperatorCallExpr. The expressions in the expression-list, if any,
13861 // are in the following arguments.
13862 //
13863 // Note that we intentionally do not visit the callee expression since
13864 // it is just a decayed reference to a function.
13865 SequenceTree::Seq PostfixExprRegion = Tree.allocate(Parent: Region);
13866 SequenceTree::Seq ArgsRegion = Tree.allocate(Parent: Region);
13867 SequenceTree::Seq OldRegion = Region;
13868
13869 assert(CXXOCE->getNumArgs() >= 1 &&
13870 "An overloaded call operator must have at least one argument"
13871 " for the postfix-expression!");
13872 const Expr *PostfixExpr = CXXOCE->getArgs()[0];
13873 llvm::ArrayRef<const Expr *> Args(CXXOCE->getArgs() + 1,
13874 CXXOCE->getNumArgs() - 1);
13875
13876 // Visit the postfix-expression first.
13877 {
13878 Region = PostfixExprRegion;
13879 SequencedSubexpression Sequenced(*this);
13880 Visit(PostfixExpr);
13881 }
13882
13883 // Then visit the argument expressions.
13884 Region = ArgsRegion;
13885 for (const Expr *Arg : Args)
13886 Visit(Arg);
13887
13888 Region = OldRegion;
13889 Tree.merge(S: PostfixExprRegion);
13890 Tree.merge(S: ArgsRegion);
13891 } else {
13892 assert(CXXOCE->getNumArgs() == 2 &&
13893 "Should only have two arguments here!");
13894 assert((SequencingKind == LHSBeforeRHS ||
13895 SequencingKind == RHSBeforeLHS) &&
13896 "Unexpected sequencing kind!");
13897
13898 // We do not visit the callee expression since it is just a decayed
13899 // reference to a function.
13900 const Expr *E1 = CXXOCE->getArg(0);
13901 const Expr *E2 = CXXOCE->getArg(1);
13902 if (SequencingKind == RHSBeforeLHS)
13903 std::swap(a&: E1, b&: E2);
13904
13905 return VisitSequencedExpressions(E1, E2);
13906 }
13907 });
13908 }
13909
13910 void VisitCXXConstructExpr(const CXXConstructExpr *CCE) {
13911 // This is a call, so all subexpressions are sequenced before the result.
13912 SequencedSubexpression Sequenced(*this);
13913
13914 if (!CCE->isListInitialization())
13915 return VisitExpr(CCE);
13916
13917 // In C++11, list initializations are sequenced.
13918 SequenceExpressionsInOrder(
13919 ExpressionList: llvm::ArrayRef(CCE->getArgs(), CCE->getNumArgs()));
13920 }
13921
13922 void VisitInitListExpr(const InitListExpr *ILE) {
13923 if (!SemaRef.getLangOpts().CPlusPlus11)
13924 return VisitExpr(ILE);
13925
13926 // In C++11, list initializations are sequenced.
13927 SequenceExpressionsInOrder(ExpressionList: ILE->inits());
13928 }
13929
13930 void VisitCXXParenListInitExpr(const CXXParenListInitExpr *PLIE) {
13931 // C++20 parenthesized list initializations are sequenced. See C++20
13932 // [decl.init.general]p16.5 and [decl.init.general]p16.6.2.2.
13933 SequenceExpressionsInOrder(ExpressionList: PLIE->getInitExprs());
13934 }
13935
13936private:
13937 void SequenceExpressionsInOrder(ArrayRef<const Expr *> ExpressionList) {
13938 SmallVector<SequenceTree::Seq, 32> Elts;
13939 SequenceTree::Seq Parent = Region;
13940 for (const Expr *E : ExpressionList) {
13941 if (!E)
13942 continue;
13943 Region = Tree.allocate(Parent);
13944 Elts.push_back(Elt: Region);
13945 Visit(E);
13946 }
13947
13948 // Forget that the initializers are sequenced.
13949 Region = Parent;
13950 for (unsigned I = 0; I < Elts.size(); ++I)
13951 Tree.merge(S: Elts[I]);
13952 }
13953};
13954
13955SequenceChecker::UsageInfo::UsageInfo() = default;
13956
13957} // namespace
13958
13959void Sema::CheckUnsequencedOperations(const Expr *E) {
13960 SmallVector<const Expr *, 8> WorkList;
13961 WorkList.push_back(Elt: E);
13962 while (!WorkList.empty()) {
13963 const Expr *Item = WorkList.pop_back_val();
13964 SequenceChecker(*this, Item, WorkList);
13965 }
13966}
13967
13968void Sema::CheckCompletedExpr(Expr *E, SourceLocation CheckLoc,
13969 bool IsConstexpr) {
13970 llvm::SaveAndRestore ConstantContext(isConstantEvaluatedOverride,
13971 IsConstexpr || isa<ConstantExpr>(Val: E));
13972 CheckImplicitConversions(E, CC: CheckLoc);
13973 if (!E->isInstantiationDependent())
13974 CheckUnsequencedOperations(E);
13975 if (!IsConstexpr && !E->isValueDependent())
13976 CheckForIntOverflow(E);
13977 DiagnoseMisalignedMembers();
13978}
13979
13980void Sema::CheckBitFieldInitialization(SourceLocation InitLoc,
13981 FieldDecl *BitField,
13982 Expr *Init) {
13983 (void) AnalyzeBitFieldAssignment(S&: *this, Bitfield: BitField, Init, InitLoc);
13984}
13985
13986static void diagnoseArrayStarInParamType(Sema &S, QualType PType,
13987 SourceLocation Loc) {
13988 if (!PType->isVariablyModifiedType())
13989 return;
13990 if (const auto *PointerTy = dyn_cast<PointerType>(Val&: PType)) {
13991 diagnoseArrayStarInParamType(S, PType: PointerTy->getPointeeType(), Loc);
13992 return;
13993 }
13994 if (const auto *ReferenceTy = dyn_cast<ReferenceType>(Val&: PType)) {
13995 diagnoseArrayStarInParamType(S, PType: ReferenceTy->getPointeeType(), Loc);
13996 return;
13997 }
13998 if (const auto *ParenTy = dyn_cast<ParenType>(Val&: PType)) {
13999 diagnoseArrayStarInParamType(S, PType: ParenTy->getInnerType(), Loc);
14000 return;
14001 }
14002
14003 const ArrayType *AT = S.Context.getAsArrayType(T: PType);
14004 if (!AT)
14005 return;
14006
14007 if (AT->getSizeModifier() != ArraySizeModifier::Star) {
14008 diagnoseArrayStarInParamType(S, PType: AT->getElementType(), Loc);
14009 return;
14010 }
14011
14012 S.Diag(Loc, diag::err_array_star_in_function_definition);
14013}
14014
14015bool Sema::CheckParmsForFunctionDef(ArrayRef<ParmVarDecl *> Parameters,
14016 bool CheckParameterNames) {
14017 bool HasInvalidParm = false;
14018 for (ParmVarDecl *Param : Parameters) {
14019 assert(Param && "null in a parameter list");
14020 // C99 6.7.5.3p4: the parameters in a parameter type list in a
14021 // function declarator that is part of a function definition of
14022 // that function shall not have incomplete type.
14023 //
14024 // C++23 [dcl.fct.def.general]/p2
14025 // The type of a parameter [...] for a function definition
14026 // shall not be a (possibly cv-qualified) class type that is incomplete
14027 // or abstract within the function body unless the function is deleted.
14028 if (!Param->isInvalidDecl() &&
14029 (RequireCompleteType(Param->getLocation(), Param->getType(),
14030 diag::err_typecheck_decl_incomplete_type) ||
14031 RequireNonAbstractType(Param->getBeginLoc(), Param->getOriginalType(),
14032 diag::err_abstract_type_in_decl,
14033 AbstractParamType))) {
14034 Param->setInvalidDecl();
14035 HasInvalidParm = true;
14036 }
14037
14038 // C99 6.9.1p5: If the declarator includes a parameter type list, the
14039 // declaration of each parameter shall include an identifier.
14040 if (CheckParameterNames && Param->getIdentifier() == nullptr &&
14041 !Param->isImplicit() && !getLangOpts().CPlusPlus) {
14042 // Diagnose this as an extension in C17 and earlier.
14043 if (!getLangOpts().C23)
14044 Diag(Param->getLocation(), diag::ext_parameter_name_omitted_c23);
14045 }
14046
14047 // C99 6.7.5.3p12:
14048 // If the function declarator is not part of a definition of that
14049 // function, parameters may have incomplete type and may use the [*]
14050 // notation in their sequences of declarator specifiers to specify
14051 // variable length array types.
14052 QualType PType = Param->getOriginalType();
14053 // FIXME: This diagnostic should point the '[*]' if source-location
14054 // information is added for it.
14055 diagnoseArrayStarInParamType(*this, PType, Param->getLocation());
14056
14057 // If the parameter is a c++ class type and it has to be destructed in the
14058 // callee function, declare the destructor so that it can be called by the
14059 // callee function. Do not perform any direct access check on the dtor here.
14060 if (!Param->isInvalidDecl()) {
14061 if (CXXRecordDecl *ClassDecl = Param->getType()->getAsCXXRecordDecl()) {
14062 if (!ClassDecl->isInvalidDecl() &&
14063 !ClassDecl->hasIrrelevantDestructor() &&
14064 !ClassDecl->isDependentContext() &&
14065 ClassDecl->isParamDestroyedInCallee()) {
14066 CXXDestructorDecl *Destructor = LookupDestructor(Class: ClassDecl);
14067 MarkFunctionReferenced(Loc: Param->getLocation(), Func: Destructor);
14068 DiagnoseUseOfDecl(D: Destructor, Locs: Param->getLocation());
14069 }
14070 }
14071 }
14072
14073 // Parameters with the pass_object_size attribute only need to be marked
14074 // constant at function definitions. Because we lack information about
14075 // whether we're on a declaration or definition when we're instantiating the
14076 // attribute, we need to check for constness here.
14077 if (const auto *Attr = Param->getAttr<PassObjectSizeAttr>())
14078 if (!Param->getType().isConstQualified())
14079 Diag(Param->getLocation(), diag::err_attribute_pointers_only)
14080 << Attr->getSpelling() << 1;
14081
14082 // Check for parameter names shadowing fields from the class.
14083 if (LangOpts.CPlusPlus && !Param->isInvalidDecl()) {
14084 // The owning context for the parameter should be the function, but we
14085 // want to see if this function's declaration context is a record.
14086 DeclContext *DC = Param->getDeclContext();
14087 if (DC && DC->isFunctionOrMethod()) {
14088 if (auto *RD = dyn_cast<CXXRecordDecl>(DC->getParent()))
14089 CheckShadowInheritedFields(Loc: Param->getLocation(), FieldName: Param->getDeclName(),
14090 RD: RD, /*DeclIsField*/ false);
14091 }
14092 }
14093
14094 if (!Param->isInvalidDecl() &&
14095 Param->getOriginalType()->isWebAssemblyTableType()) {
14096 Param->setInvalidDecl();
14097 HasInvalidParm = true;
14098 Diag(Param->getLocation(), diag::err_wasm_table_as_function_parameter);
14099 }
14100 }
14101
14102 return HasInvalidParm;
14103}
14104
14105std::optional<std::pair<
14106 CharUnits, CharUnits>> static getBaseAlignmentAndOffsetFromPtr(const Expr
14107 *E,
14108 ASTContext
14109 &Ctx);
14110
14111/// Compute the alignment and offset of the base class object given the
14112/// derived-to-base cast expression and the alignment and offset of the derived
14113/// class object.
14114static std::pair<CharUnits, CharUnits>
14115getDerivedToBaseAlignmentAndOffset(const CastExpr *CE, QualType DerivedType,
14116 CharUnits BaseAlignment, CharUnits Offset,
14117 ASTContext &Ctx) {
14118 for (auto PathI = CE->path_begin(), PathE = CE->path_end(); PathI != PathE;
14119 ++PathI) {
14120 const CXXBaseSpecifier *Base = *PathI;
14121 const CXXRecordDecl *BaseDecl = Base->getType()->getAsCXXRecordDecl();
14122 if (Base->isVirtual()) {
14123 // The complete object may have a lower alignment than the non-virtual
14124 // alignment of the base, in which case the base may be misaligned. Choose
14125 // the smaller of the non-virtual alignment and BaseAlignment, which is a
14126 // conservative lower bound of the complete object alignment.
14127 CharUnits NonVirtualAlignment =
14128 Ctx.getASTRecordLayout(BaseDecl).getNonVirtualAlignment();
14129 BaseAlignment = std::min(a: BaseAlignment, b: NonVirtualAlignment);
14130 Offset = CharUnits::Zero();
14131 } else {
14132 const ASTRecordLayout &RL =
14133 Ctx.getASTRecordLayout(DerivedType->getAsCXXRecordDecl());
14134 Offset += RL.getBaseClassOffset(Base: BaseDecl);
14135 }
14136 DerivedType = Base->getType();
14137 }
14138
14139 return std::make_pair(x&: BaseAlignment, y&: Offset);
14140}
14141
14142/// Compute the alignment and offset of a binary additive operator.
14143static std::optional<std::pair<CharUnits, CharUnits>>
14144getAlignmentAndOffsetFromBinAddOrSub(const Expr *PtrE, const Expr *IntE,
14145 bool IsSub, ASTContext &Ctx) {
14146 QualType PointeeType = PtrE->getType()->getPointeeType();
14147
14148 if (!PointeeType->isConstantSizeType())
14149 return std::nullopt;
14150
14151 auto P = getBaseAlignmentAndOffsetFromPtr(E: PtrE, Ctx);
14152
14153 if (!P)
14154 return std::nullopt;
14155
14156 CharUnits EltSize = Ctx.getTypeSizeInChars(T: PointeeType);
14157 if (std::optional<llvm::APSInt> IdxRes = IntE->getIntegerConstantExpr(Ctx)) {
14158 CharUnits Offset = EltSize * IdxRes->getExtValue();
14159 if (IsSub)
14160 Offset = -Offset;
14161 return std::make_pair(x&: P->first, y: P->second + Offset);
14162 }
14163
14164 // If the integer expression isn't a constant expression, compute the lower
14165 // bound of the alignment using the alignment and offset of the pointer
14166 // expression and the element size.
14167 return std::make_pair(
14168 x: P->first.alignmentAtOffset(offset: P->second).alignmentAtOffset(offset: EltSize),
14169 y: CharUnits::Zero());
14170}
14171
14172/// This helper function takes an lvalue expression and returns the alignment of
14173/// a VarDecl and a constant offset from the VarDecl.
14174std::optional<std::pair<
14175 CharUnits,
14176 CharUnits>> static getBaseAlignmentAndOffsetFromLValue(const Expr *E,
14177 ASTContext &Ctx) {
14178 E = E->IgnoreParens();
14179 switch (E->getStmtClass()) {
14180 default:
14181 break;
14182 case Stmt::CStyleCastExprClass:
14183 case Stmt::CXXStaticCastExprClass:
14184 case Stmt::ImplicitCastExprClass: {
14185 auto *CE = cast<CastExpr>(Val: E);
14186 const Expr *From = CE->getSubExpr();
14187 switch (CE->getCastKind()) {
14188 default:
14189 break;
14190 case CK_NoOp:
14191 return getBaseAlignmentAndOffsetFromLValue(E: From, Ctx);
14192 case CK_UncheckedDerivedToBase:
14193 case CK_DerivedToBase: {
14194 auto P = getBaseAlignmentAndOffsetFromLValue(E: From, Ctx);
14195 if (!P)
14196 break;
14197 return getDerivedToBaseAlignmentAndOffset(CE, DerivedType: From->getType(), BaseAlignment: P->first,
14198 Offset: P->second, Ctx);
14199 }
14200 }
14201 break;
14202 }
14203 case Stmt::ArraySubscriptExprClass: {
14204 auto *ASE = cast<ArraySubscriptExpr>(Val: E);
14205 return getAlignmentAndOffsetFromBinAddOrSub(PtrE: ASE->getBase(), IntE: ASE->getIdx(),
14206 IsSub: false, Ctx);
14207 }
14208 case Stmt::DeclRefExprClass: {
14209 if (auto *VD = dyn_cast<VarDecl>(Val: cast<DeclRefExpr>(Val: E)->getDecl())) {
14210 // FIXME: If VD is captured by copy or is an escaping __block variable,
14211 // use the alignment of VD's type.
14212 if (!VD->getType()->isReferenceType()) {
14213 // Dependent alignment cannot be resolved -> bail out.
14214 if (VD->hasDependentAlignment())
14215 break;
14216 return std::make_pair(x: Ctx.getDeclAlign(VD), y: CharUnits::Zero());
14217 }
14218 if (VD->hasInit())
14219 return getBaseAlignmentAndOffsetFromLValue(E: VD->getInit(), Ctx);
14220 }
14221 break;
14222 }
14223 case Stmt::MemberExprClass: {
14224 auto *ME = cast<MemberExpr>(Val: E);
14225 auto *FD = dyn_cast<FieldDecl>(Val: ME->getMemberDecl());
14226 if (!FD || FD->getType()->isReferenceType() ||
14227 FD->getParent()->isInvalidDecl())
14228 break;
14229 std::optional<std::pair<CharUnits, CharUnits>> P;
14230 if (ME->isArrow())
14231 P = getBaseAlignmentAndOffsetFromPtr(E: ME->getBase(), Ctx);
14232 else
14233 P = getBaseAlignmentAndOffsetFromLValue(E: ME->getBase(), Ctx);
14234 if (!P)
14235 break;
14236 const ASTRecordLayout &Layout = Ctx.getASTRecordLayout(D: FD->getParent());
14237 uint64_t Offset = Layout.getFieldOffset(FieldNo: FD->getFieldIndex());
14238 return std::make_pair(x&: P->first,
14239 y: P->second + CharUnits::fromQuantity(Quantity: Offset));
14240 }
14241 case Stmt::UnaryOperatorClass: {
14242 auto *UO = cast<UnaryOperator>(Val: E);
14243 switch (UO->getOpcode()) {
14244 default:
14245 break;
14246 case UO_Deref:
14247 return getBaseAlignmentAndOffsetFromPtr(E: UO->getSubExpr(), Ctx);
14248 }
14249 break;
14250 }
14251 case Stmt::BinaryOperatorClass: {
14252 auto *BO = cast<BinaryOperator>(Val: E);
14253 auto Opcode = BO->getOpcode();
14254 switch (Opcode) {
14255 default:
14256 break;
14257 case BO_Comma:
14258 return getBaseAlignmentAndOffsetFromLValue(E: BO->getRHS(), Ctx);
14259 }
14260 break;
14261 }
14262 }
14263 return std::nullopt;
14264}
14265
14266/// This helper function takes a pointer expression and returns the alignment of
14267/// a VarDecl and a constant offset from the VarDecl.
14268std::optional<std::pair<
14269 CharUnits, CharUnits>> static getBaseAlignmentAndOffsetFromPtr(const Expr
14270 *E,
14271 ASTContext
14272 &Ctx) {
14273 E = E->IgnoreParens();
14274 switch (E->getStmtClass()) {
14275 default:
14276 break;
14277 case Stmt::CStyleCastExprClass:
14278 case Stmt::CXXStaticCastExprClass:
14279 case Stmt::ImplicitCastExprClass: {
14280 auto *CE = cast<CastExpr>(Val: E);
14281 const Expr *From = CE->getSubExpr();
14282 switch (CE->getCastKind()) {
14283 default:
14284 break;
14285 case CK_NoOp:
14286 return getBaseAlignmentAndOffsetFromPtr(E: From, Ctx);
14287 case CK_ArrayToPointerDecay:
14288 return getBaseAlignmentAndOffsetFromLValue(E: From, Ctx);
14289 case CK_UncheckedDerivedToBase:
14290 case CK_DerivedToBase: {
14291 auto P = getBaseAlignmentAndOffsetFromPtr(E: From, Ctx);
14292 if (!P)
14293 break;
14294 return getDerivedToBaseAlignmentAndOffset(
14295 CE, DerivedType: From->getType()->getPointeeType(), BaseAlignment: P->first, Offset: P->second, Ctx);
14296 }
14297 }
14298 break;
14299 }
14300 case Stmt::CXXThisExprClass: {
14301 auto *RD = E->getType()->getPointeeType()->getAsCXXRecordDecl();
14302 CharUnits Alignment = Ctx.getASTRecordLayout(RD).getNonVirtualAlignment();
14303 return std::make_pair(x&: Alignment, y: CharUnits::Zero());
14304 }
14305 case Stmt::UnaryOperatorClass: {
14306 auto *UO = cast<UnaryOperator>(Val: E);
14307 if (UO->getOpcode() == UO_AddrOf)
14308 return getBaseAlignmentAndOffsetFromLValue(E: UO->getSubExpr(), Ctx);
14309 break;
14310 }
14311 case Stmt::BinaryOperatorClass: {
14312 auto *BO = cast<BinaryOperator>(Val: E);
14313 auto Opcode = BO->getOpcode();
14314 switch (Opcode) {
14315 default:
14316 break;
14317 case BO_Add:
14318 case BO_Sub: {
14319 const Expr *LHS = BO->getLHS(), *RHS = BO->getRHS();
14320 if (Opcode == BO_Add && !RHS->getType()->isIntegralOrEnumerationType())
14321 std::swap(a&: LHS, b&: RHS);
14322 return getAlignmentAndOffsetFromBinAddOrSub(PtrE: LHS, IntE: RHS, IsSub: Opcode == BO_Sub,
14323 Ctx);
14324 }
14325 case BO_Comma:
14326 return getBaseAlignmentAndOffsetFromPtr(E: BO->getRHS(), Ctx);
14327 }
14328 break;
14329 }
14330 }
14331 return std::nullopt;
14332}
14333
14334static CharUnits getPresumedAlignmentOfPointer(const Expr *E, Sema &S) {
14335 // See if we can compute the alignment of a VarDecl and an offset from it.
14336 std::optional<std::pair<CharUnits, CharUnits>> P =
14337 getBaseAlignmentAndOffsetFromPtr(E, Ctx&: S.Context);
14338
14339 if (P)
14340 return P->first.alignmentAtOffset(offset: P->second);
14341
14342 // If that failed, return the type's alignment.
14343 return S.Context.getTypeAlignInChars(T: E->getType()->getPointeeType());
14344}
14345
14346void Sema::CheckCastAlign(Expr *Op, QualType T, SourceRange TRange) {
14347 // This is actually a lot of work to potentially be doing on every
14348 // cast; don't do it if we're ignoring -Wcast_align (as is the default).
14349 if (getDiagnostics().isIgnored(diag::warn_cast_align, TRange.getBegin()))
14350 return;
14351
14352 // Ignore dependent types.
14353 if (T->isDependentType() || Op->getType()->isDependentType())
14354 return;
14355
14356 // Require that the destination be a pointer type.
14357 const PointerType *DestPtr = T->getAs<PointerType>();
14358 if (!DestPtr) return;
14359
14360 // If the destination has alignment 1, we're done.
14361 QualType DestPointee = DestPtr->getPointeeType();
14362 if (DestPointee->isIncompleteType()) return;
14363 CharUnits DestAlign = Context.getTypeAlignInChars(T: DestPointee);
14364 if (DestAlign.isOne()) return;
14365
14366 // Require that the source be a pointer type.
14367 const PointerType *SrcPtr = Op->getType()->getAs<PointerType>();
14368 if (!SrcPtr) return;
14369 QualType SrcPointee = SrcPtr->getPointeeType();
14370
14371 // Explicitly allow casts from cv void*. We already implicitly
14372 // allowed casts to cv void*, since they have alignment 1.
14373 // Also allow casts involving incomplete types, which implicitly
14374 // includes 'void'.
14375 if (SrcPointee->isIncompleteType()) return;
14376
14377 CharUnits SrcAlign = getPresumedAlignmentOfPointer(E: Op, S&: *this);
14378
14379 if (SrcAlign >= DestAlign) return;
14380
14381 Diag(TRange.getBegin(), diag::warn_cast_align)
14382 << Op->getType() << T
14383 << static_cast<unsigned>(SrcAlign.getQuantity())
14384 << static_cast<unsigned>(DestAlign.getQuantity())
14385 << TRange << Op->getSourceRange();
14386}
14387
14388void Sema::CheckArrayAccess(const Expr *BaseExpr, const Expr *IndexExpr,
14389 const ArraySubscriptExpr *ASE,
14390 bool AllowOnePastEnd, bool IndexNegated) {
14391 // Already diagnosed by the constant evaluator.
14392 if (isConstantEvaluatedContext())
14393 return;
14394
14395 IndexExpr = IndexExpr->IgnoreParenImpCasts();
14396 if (IndexExpr->isValueDependent())
14397 return;
14398
14399 const Type *EffectiveType =
14400 BaseExpr->getType()->getPointeeOrArrayElementType();
14401 BaseExpr = BaseExpr->IgnoreParenCasts();
14402 const ConstantArrayType *ArrayTy =
14403 Context.getAsConstantArrayType(T: BaseExpr->getType());
14404
14405 LangOptions::StrictFlexArraysLevelKind
14406 StrictFlexArraysLevel = getLangOpts().getStrictFlexArraysLevel();
14407
14408 const Type *BaseType =
14409 ArrayTy == nullptr ? nullptr : ArrayTy->getElementType().getTypePtr();
14410 bool IsUnboundedArray =
14411 BaseType == nullptr || BaseExpr->isFlexibleArrayMemberLike(
14412 Context, StrictFlexArraysLevel,
14413 /*IgnoreTemplateOrMacroSubstitution=*/true);
14414 if (EffectiveType->isDependentType() ||
14415 (!IsUnboundedArray && BaseType->isDependentType()))
14416 return;
14417
14418 Expr::EvalResult Result;
14419 if (!IndexExpr->EvaluateAsInt(Result, Ctx: Context, AllowSideEffects: Expr::SE_AllowSideEffects))
14420 return;
14421
14422 llvm::APSInt index = Result.Val.getInt();
14423 if (IndexNegated) {
14424 index.setIsUnsigned(false);
14425 index = -index;
14426 }
14427
14428 if (IsUnboundedArray) {
14429 if (EffectiveType->isFunctionType())
14430 return;
14431 if (index.isUnsigned() || !index.isNegative()) {
14432 const auto &ASTC = getASTContext();
14433 unsigned AddrBits = ASTC.getTargetInfo().getPointerWidth(
14434 AddrSpace: EffectiveType->getCanonicalTypeInternal().getAddressSpace());
14435 if (index.getBitWidth() < AddrBits)
14436 index = index.zext(width: AddrBits);
14437 std::optional<CharUnits> ElemCharUnits =
14438 ASTC.getTypeSizeInCharsIfKnown(Ty: EffectiveType);
14439 // PR50741 - If EffectiveType has unknown size (e.g., if it's a void
14440 // pointer) bounds-checking isn't meaningful.
14441 if (!ElemCharUnits || ElemCharUnits->isZero())
14442 return;
14443 llvm::APInt ElemBytes(index.getBitWidth(), ElemCharUnits->getQuantity());
14444 // If index has more active bits than address space, we already know
14445 // we have a bounds violation to warn about. Otherwise, compute
14446 // address of (index + 1)th element, and warn about bounds violation
14447 // only if that address exceeds address space.
14448 if (index.getActiveBits() <= AddrBits) {
14449 bool Overflow;
14450 llvm::APInt Product(index);
14451 Product += 1;
14452 Product = Product.umul_ov(RHS: ElemBytes, Overflow);
14453 if (!Overflow && Product.getActiveBits() <= AddrBits)
14454 return;
14455 }
14456
14457 // Need to compute max possible elements in address space, since that
14458 // is included in diag message.
14459 llvm::APInt MaxElems = llvm::APInt::getMaxValue(numBits: AddrBits);
14460 MaxElems = MaxElems.zext(width: std::max(a: AddrBits + 1, b: ElemBytes.getBitWidth()));
14461 MaxElems += 1;
14462 ElemBytes = ElemBytes.zextOrTrunc(width: MaxElems.getBitWidth());
14463 MaxElems = MaxElems.udiv(RHS: ElemBytes);
14464
14465 unsigned DiagID =
14466 ASE ? diag::warn_array_index_exceeds_max_addressable_bounds
14467 : diag::warn_ptr_arith_exceeds_max_addressable_bounds;
14468
14469 // Diag message shows element size in bits and in "bytes" (platform-
14470 // dependent CharUnits)
14471 DiagRuntimeBehavior(BaseExpr->getBeginLoc(), BaseExpr,
14472 PDiag(DiagID)
14473 << toString(I: index, Radix: 10, Signed: true) << AddrBits
14474 << (unsigned)ASTC.toBits(CharSize: *ElemCharUnits)
14475 << toString(I: ElemBytes, Radix: 10, Signed: false)
14476 << toString(I: MaxElems, Radix: 10, Signed: false)
14477 << (unsigned)MaxElems.getLimitedValue(Limit: ~0U)
14478 << IndexExpr->getSourceRange());
14479
14480 const NamedDecl *ND = nullptr;
14481 // Try harder to find a NamedDecl to point at in the note.
14482 while (const auto *ASE = dyn_cast<ArraySubscriptExpr>(Val: BaseExpr))
14483 BaseExpr = ASE->getBase()->IgnoreParenCasts();
14484 if (const auto *DRE = dyn_cast<DeclRefExpr>(Val: BaseExpr))
14485 ND = DRE->getDecl();
14486 if (const auto *ME = dyn_cast<MemberExpr>(Val: BaseExpr))
14487 ND = ME->getMemberDecl();
14488
14489 if (ND)
14490 DiagRuntimeBehavior(ND->getBeginLoc(), BaseExpr,
14491 PDiag(diag::note_array_declared_here) << ND);
14492 }
14493 return;
14494 }
14495
14496 if (index.isUnsigned() || !index.isNegative()) {
14497 // It is possible that the type of the base expression after
14498 // IgnoreParenCasts is incomplete, even though the type of the base
14499 // expression before IgnoreParenCasts is complete (see PR39746 for an
14500 // example). In this case we have no information about whether the array
14501 // access exceeds the array bounds. However we can still diagnose an array
14502 // access which precedes the array bounds.
14503 if (BaseType->isIncompleteType())
14504 return;
14505
14506 llvm::APInt size = ArrayTy->getSize();
14507
14508 if (BaseType != EffectiveType) {
14509 // Make sure we're comparing apples to apples when comparing index to
14510 // size.
14511 uint64_t ptrarith_typesize = Context.getTypeSize(T: EffectiveType);
14512 uint64_t array_typesize = Context.getTypeSize(T: BaseType);
14513
14514 // Handle ptrarith_typesize being zero, such as when casting to void*.
14515 // Use the size in bits (what "getTypeSize()" returns) rather than bytes.
14516 if (!ptrarith_typesize)
14517 ptrarith_typesize = Context.getCharWidth();
14518
14519 if (ptrarith_typesize != array_typesize) {
14520 // There's a cast to a different size type involved.
14521 uint64_t ratio = array_typesize / ptrarith_typesize;
14522
14523 // TODO: Be smarter about handling cases where array_typesize is not a
14524 // multiple of ptrarith_typesize.
14525 if (ptrarith_typesize * ratio == array_typesize)
14526 size *= llvm::APInt(size.getBitWidth(), ratio);
14527 }
14528 }
14529
14530 if (size.getBitWidth() > index.getBitWidth())
14531 index = index.zext(width: size.getBitWidth());
14532 else if (size.getBitWidth() < index.getBitWidth())
14533 size = size.zext(width: index.getBitWidth());
14534
14535 // For array subscripting the index must be less than size, but for pointer
14536 // arithmetic also allow the index (offset) to be equal to size since
14537 // computing the next address after the end of the array is legal and
14538 // commonly done e.g. in C++ iterators and range-based for loops.
14539 if (AllowOnePastEnd ? index.ule(RHS: size) : index.ult(RHS: size))
14540 return;
14541
14542 // Suppress the warning if the subscript expression (as identified by the
14543 // ']' location) and the index expression are both from macro expansions
14544 // within a system header.
14545 if (ASE) {
14546 SourceLocation RBracketLoc = SourceMgr.getSpellingLoc(
14547 Loc: ASE->getRBracketLoc());
14548 if (SourceMgr.isInSystemHeader(Loc: RBracketLoc)) {
14549 SourceLocation IndexLoc =
14550 SourceMgr.getSpellingLoc(Loc: IndexExpr->getBeginLoc());
14551 if (SourceMgr.isWrittenInSameFile(Loc1: RBracketLoc, Loc2: IndexLoc))
14552 return;
14553 }
14554 }
14555
14556 unsigned DiagID = ASE ? diag::warn_array_index_exceeds_bounds
14557 : diag::warn_ptr_arith_exceeds_bounds;
14558 unsigned CastMsg = (!ASE || BaseType == EffectiveType) ? 0 : 1;
14559 QualType CastMsgTy = ASE ? ASE->getLHS()->getType() : QualType();
14560
14561 DiagRuntimeBehavior(
14562 BaseExpr->getBeginLoc(), BaseExpr,
14563 PDiag(DiagID) << toString(I: index, Radix: 10, Signed: true) << ArrayTy->desugar()
14564 << CastMsg << CastMsgTy << IndexExpr->getSourceRange());
14565 } else {
14566 unsigned DiagID = diag::warn_array_index_precedes_bounds;
14567 if (!ASE) {
14568 DiagID = diag::warn_ptr_arith_precedes_bounds;
14569 if (index.isNegative()) index = -index;
14570 }
14571
14572 DiagRuntimeBehavior(BaseExpr->getBeginLoc(), BaseExpr,
14573 PDiag(DiagID) << toString(I: index, Radix: 10, Signed: true)
14574 << IndexExpr->getSourceRange());
14575 }
14576
14577 const NamedDecl *ND = nullptr;
14578 // Try harder to find a NamedDecl to point at in the note.
14579 while (const auto *ASE = dyn_cast<ArraySubscriptExpr>(Val: BaseExpr))
14580 BaseExpr = ASE->getBase()->IgnoreParenCasts();
14581 if (const auto *DRE = dyn_cast<DeclRefExpr>(Val: BaseExpr))
14582 ND = DRE->getDecl();
14583 if (const auto *ME = dyn_cast<MemberExpr>(Val: BaseExpr))
14584 ND = ME->getMemberDecl();
14585
14586 if (ND)
14587 DiagRuntimeBehavior(ND->getBeginLoc(), BaseExpr,
14588 PDiag(diag::note_array_declared_here) << ND);
14589}
14590
14591void Sema::CheckArrayAccess(const Expr *expr) {
14592 int AllowOnePastEnd = 0;
14593 while (expr) {
14594 expr = expr->IgnoreParenImpCasts();
14595 switch (expr->getStmtClass()) {
14596 case Stmt::ArraySubscriptExprClass: {
14597 const ArraySubscriptExpr *ASE = cast<ArraySubscriptExpr>(Val: expr);
14598 CheckArrayAccess(BaseExpr: ASE->getBase(), IndexExpr: ASE->getIdx(), ASE,
14599 AllowOnePastEnd: AllowOnePastEnd > 0);
14600 expr = ASE->getBase();
14601 break;
14602 }
14603 case Stmt::MemberExprClass: {
14604 expr = cast<MemberExpr>(Val: expr)->getBase();
14605 break;
14606 }
14607 case Stmt::ArraySectionExprClass: {
14608 const ArraySectionExpr *ASE = cast<ArraySectionExpr>(Val: expr);
14609 // FIXME: We should probably be checking all of the elements to the
14610 // 'length' here as well.
14611 if (ASE->getLowerBound())
14612 CheckArrayAccess(BaseExpr: ASE->getBase(), IndexExpr: ASE->getLowerBound(),
14613 /*ASE=*/nullptr, AllowOnePastEnd: AllowOnePastEnd > 0);
14614 return;
14615 }
14616 case Stmt::UnaryOperatorClass: {
14617 // Only unwrap the * and & unary operators
14618 const UnaryOperator *UO = cast<UnaryOperator>(Val: expr);
14619 expr = UO->getSubExpr();
14620 switch (UO->getOpcode()) {
14621 case UO_AddrOf:
14622 AllowOnePastEnd++;
14623 break;
14624 case UO_Deref:
14625 AllowOnePastEnd--;
14626 break;
14627 default:
14628 return;
14629 }
14630 break;
14631 }
14632 case Stmt::ConditionalOperatorClass: {
14633 const ConditionalOperator *cond = cast<ConditionalOperator>(Val: expr);
14634 if (const Expr *lhs = cond->getLHS())
14635 CheckArrayAccess(expr: lhs);
14636 if (const Expr *rhs = cond->getRHS())
14637 CheckArrayAccess(expr: rhs);
14638 return;
14639 }
14640 case Stmt::CXXOperatorCallExprClass: {
14641 const auto *OCE = cast<CXXOperatorCallExpr>(Val: expr);
14642 for (const auto *Arg : OCE->arguments())
14643 CheckArrayAccess(Arg);
14644 return;
14645 }
14646 default:
14647 return;
14648 }
14649 }
14650}
14651
14652static bool checkUnsafeAssignLiteral(Sema &S, SourceLocation Loc,
14653 Expr *RHS, bool isProperty) {
14654 // Check if RHS is an Objective-C object literal, which also can get
14655 // immediately zapped in a weak reference. Note that we explicitly
14656 // allow ObjCStringLiterals, since those are designed to never really die.
14657 RHS = RHS->IgnoreParenImpCasts();
14658
14659 // This enum needs to match with the 'select' in
14660 // warn_objc_arc_literal_assign (off-by-1).
14661 SemaObjC::ObjCLiteralKind Kind = S.ObjC().CheckLiteralKind(FromE: RHS);
14662 if (Kind == SemaObjC::LK_String || Kind == SemaObjC::LK_None)
14663 return false;
14664
14665 S.Diag(Loc, diag::warn_arc_literal_assign)
14666 << (unsigned) Kind
14667 << (isProperty ? 0 : 1)
14668 << RHS->getSourceRange();
14669
14670 return true;
14671}
14672
14673static bool checkUnsafeAssignObject(Sema &S, SourceLocation Loc,
14674 Qualifiers::ObjCLifetime LT,
14675 Expr *RHS, bool isProperty) {
14676 // Strip off any implicit cast added to get to the one ARC-specific.
14677 while (ImplicitCastExpr *cast = dyn_cast<ImplicitCastExpr>(Val: RHS)) {
14678 if (cast->getCastKind() == CK_ARCConsumeObject) {
14679 S.Diag(Loc, diag::warn_arc_retained_assign)
14680 << (LT == Qualifiers::OCL_ExplicitNone)
14681 << (isProperty ? 0 : 1)
14682 << RHS->getSourceRange();
14683 return true;
14684 }
14685 RHS = cast->getSubExpr();
14686 }
14687
14688 if (LT == Qualifiers::OCL_Weak &&
14689 checkUnsafeAssignLiteral(S, Loc, RHS, isProperty))
14690 return true;
14691
14692 return false;
14693}
14694
14695bool Sema::checkUnsafeAssigns(SourceLocation Loc,
14696 QualType LHS, Expr *RHS) {
14697 Qualifiers::ObjCLifetime LT = LHS.getObjCLifetime();
14698
14699 if (LT != Qualifiers::OCL_Weak && LT != Qualifiers::OCL_ExplicitNone)
14700 return false;
14701
14702 if (checkUnsafeAssignObject(S&: *this, Loc, LT, RHS, isProperty: false))
14703 return true;
14704
14705 return false;
14706}
14707
14708void Sema::checkUnsafeExprAssigns(SourceLocation Loc,
14709 Expr *LHS, Expr *RHS) {
14710 QualType LHSType;
14711 // PropertyRef on LHS type need be directly obtained from
14712 // its declaration as it has a PseudoType.
14713 ObjCPropertyRefExpr *PRE
14714 = dyn_cast<ObjCPropertyRefExpr>(Val: LHS->IgnoreParens());
14715 if (PRE && !PRE->isImplicitProperty()) {
14716 const ObjCPropertyDecl *PD = PRE->getExplicitProperty();
14717 if (PD)
14718 LHSType = PD->getType();
14719 }
14720
14721 if (LHSType.isNull())
14722 LHSType = LHS->getType();
14723
14724 Qualifiers::ObjCLifetime LT = LHSType.getObjCLifetime();
14725
14726 if (LT == Qualifiers::OCL_Weak) {
14727 if (!Diags.isIgnored(diag::warn_arc_repeated_use_of_weak, Loc))
14728 getCurFunction()->markSafeWeakUse(E: LHS);
14729 }
14730
14731 if (checkUnsafeAssigns(Loc, LHS: LHSType, RHS))
14732 return;
14733
14734 // FIXME. Check for other life times.
14735 if (LT != Qualifiers::OCL_None)
14736 return;
14737
14738 if (PRE) {
14739 if (PRE->isImplicitProperty())
14740 return;
14741 const ObjCPropertyDecl *PD = PRE->getExplicitProperty();
14742 if (!PD)
14743 return;
14744
14745 unsigned Attributes = PD->getPropertyAttributes();
14746 if (Attributes & ObjCPropertyAttribute::kind_assign) {
14747 // when 'assign' attribute was not explicitly specified
14748 // by user, ignore it and rely on property type itself
14749 // for lifetime info.
14750 unsigned AsWrittenAttr = PD->getPropertyAttributesAsWritten();
14751 if (!(AsWrittenAttr & ObjCPropertyAttribute::kind_assign) &&
14752 LHSType->isObjCRetainableType())
14753 return;
14754
14755 while (ImplicitCastExpr *cast = dyn_cast<ImplicitCastExpr>(Val: RHS)) {
14756 if (cast->getCastKind() == CK_ARCConsumeObject) {
14757 Diag(Loc, diag::warn_arc_retained_property_assign)
14758 << RHS->getSourceRange();
14759 return;
14760 }
14761 RHS = cast->getSubExpr();
14762 }
14763 } else if (Attributes & ObjCPropertyAttribute::kind_weak) {
14764 if (checkUnsafeAssignObject(S&: *this, Loc, LT: Qualifiers::OCL_Weak, RHS, isProperty: true))
14765 return;
14766 }
14767 }
14768}
14769
14770//===--- CHECK: Empty statement body (-Wempty-body) ---------------------===//
14771
14772static bool ShouldDiagnoseEmptyStmtBody(const SourceManager &SourceMgr,
14773 SourceLocation StmtLoc,
14774 const NullStmt *Body) {
14775 // Do not warn if the body is a macro that expands to nothing, e.g:
14776 //
14777 // #define CALL(x)
14778 // if (condition)
14779 // CALL(0);
14780 if (Body->hasLeadingEmptyMacro())
14781 return false;
14782
14783 // Get line numbers of statement and body.
14784 bool StmtLineInvalid;
14785 unsigned StmtLine = SourceMgr.getPresumedLineNumber(Loc: StmtLoc,
14786 Invalid: &StmtLineInvalid);
14787 if (StmtLineInvalid)
14788 return false;
14789
14790 bool BodyLineInvalid;
14791 unsigned BodyLine = SourceMgr.getSpellingLineNumber(Loc: Body->getSemiLoc(),
14792 Invalid: &BodyLineInvalid);
14793 if (BodyLineInvalid)
14794 return false;
14795
14796 // Warn if null statement and body are on the same line.
14797 if (StmtLine != BodyLine)
14798 return false;
14799
14800 return true;
14801}
14802
14803void Sema::DiagnoseEmptyStmtBody(SourceLocation StmtLoc,
14804 const Stmt *Body,
14805 unsigned DiagID) {
14806 // Since this is a syntactic check, don't emit diagnostic for template
14807 // instantiations, this just adds noise.
14808 if (CurrentInstantiationScope)
14809 return;
14810
14811 // The body should be a null statement.
14812 const NullStmt *NBody = dyn_cast<NullStmt>(Val: Body);
14813 if (!NBody)
14814 return;
14815
14816 // Do the usual checks.
14817 if (!ShouldDiagnoseEmptyStmtBody(SourceMgr, StmtLoc, Body: NBody))
14818 return;
14819
14820 Diag(NBody->getSemiLoc(), DiagID);
14821 Diag(NBody->getSemiLoc(), diag::note_empty_body_on_separate_line);
14822}
14823
14824void Sema::DiagnoseEmptyLoopBody(const Stmt *S,
14825 const Stmt *PossibleBody) {
14826 assert(!CurrentInstantiationScope); // Ensured by caller
14827
14828 SourceLocation StmtLoc;
14829 const Stmt *Body;
14830 unsigned DiagID;
14831 if (const ForStmt *FS = dyn_cast<ForStmt>(Val: S)) {
14832 StmtLoc = FS->getRParenLoc();
14833 Body = FS->getBody();
14834 DiagID = diag::warn_empty_for_body;
14835 } else if (const WhileStmt *WS = dyn_cast<WhileStmt>(Val: S)) {
14836 StmtLoc = WS->getRParenLoc();
14837 Body = WS->getBody();
14838 DiagID = diag::warn_empty_while_body;
14839 } else
14840 return; // Neither `for' nor `while'.
14841
14842 // The body should be a null statement.
14843 const NullStmt *NBody = dyn_cast<NullStmt>(Val: Body);
14844 if (!NBody)
14845 return;
14846
14847 // Skip expensive checks if diagnostic is disabled.
14848 if (Diags.isIgnored(DiagID, Loc: NBody->getSemiLoc()))
14849 return;
14850
14851 // Do the usual checks.
14852 if (!ShouldDiagnoseEmptyStmtBody(SourceMgr, StmtLoc, Body: NBody))
14853 return;
14854
14855 // `for(...);' and `while(...);' are popular idioms, so in order to keep
14856 // noise level low, emit diagnostics only if for/while is followed by a
14857 // CompoundStmt, e.g.:
14858 // for (int i = 0; i < n; i++);
14859 // {
14860 // a(i);
14861 // }
14862 // or if for/while is followed by a statement with more indentation
14863 // than for/while itself:
14864 // for (int i = 0; i < n; i++);
14865 // a(i);
14866 bool ProbableTypo = isa<CompoundStmt>(Val: PossibleBody);
14867 if (!ProbableTypo) {
14868 bool BodyColInvalid;
14869 unsigned BodyCol = SourceMgr.getPresumedColumnNumber(
14870 Loc: PossibleBody->getBeginLoc(), Invalid: &BodyColInvalid);
14871 if (BodyColInvalid)
14872 return;
14873
14874 bool StmtColInvalid;
14875 unsigned StmtCol =
14876 SourceMgr.getPresumedColumnNumber(Loc: S->getBeginLoc(), Invalid: &StmtColInvalid);
14877 if (StmtColInvalid)
14878 return;
14879
14880 if (BodyCol > StmtCol)
14881 ProbableTypo = true;
14882 }
14883
14884 if (ProbableTypo) {
14885 Diag(NBody->getSemiLoc(), DiagID);
14886 Diag(NBody->getSemiLoc(), diag::note_empty_body_on_separate_line);
14887 }
14888}
14889
14890//===--- CHECK: Warn on self move with std::move. -------------------------===//
14891
14892void Sema::DiagnoseSelfMove(const Expr *LHSExpr, const Expr *RHSExpr,
14893 SourceLocation OpLoc) {
14894 if (Diags.isIgnored(diag::warn_sizeof_pointer_expr_memaccess, OpLoc))
14895 return;
14896
14897 if (inTemplateInstantiation())
14898 return;
14899
14900 // Strip parens and casts away.
14901 LHSExpr = LHSExpr->IgnoreParenImpCasts();
14902 RHSExpr = RHSExpr->IgnoreParenImpCasts();
14903
14904 // Check for a call to std::move or for a static_cast<T&&>(..) to an xvalue
14905 // which we can treat as an inlined std::move
14906 if (const auto *CE = dyn_cast<CallExpr>(Val: RHSExpr);
14907 CE && CE->getNumArgs() == 1 && CE->isCallToStdMove())
14908 RHSExpr = CE->getArg(Arg: 0);
14909 else if (const auto *CXXSCE = dyn_cast<CXXStaticCastExpr>(Val: RHSExpr);
14910 CXXSCE && CXXSCE->isXValue())
14911 RHSExpr = CXXSCE->getSubExpr();
14912 else
14913 return;
14914
14915 const DeclRefExpr *LHSDeclRef = dyn_cast<DeclRefExpr>(Val: LHSExpr);
14916 const DeclRefExpr *RHSDeclRef = dyn_cast<DeclRefExpr>(Val: RHSExpr);
14917
14918 // Two DeclRefExpr's, check that the decls are the same.
14919 if (LHSDeclRef && RHSDeclRef) {
14920 if (!LHSDeclRef->getDecl() || !RHSDeclRef->getDecl())
14921 return;
14922 if (LHSDeclRef->getDecl()->getCanonicalDecl() !=
14923 RHSDeclRef->getDecl()->getCanonicalDecl())
14924 return;
14925
14926 auto D = Diag(OpLoc, diag::warn_self_move)
14927 << LHSExpr->getType() << LHSExpr->getSourceRange()
14928 << RHSExpr->getSourceRange();
14929 if (const FieldDecl *F =
14930 getSelfAssignmentClassMemberCandidate(SelfAssigned: RHSDeclRef->getDecl()))
14931 D << 1 << F
14932 << FixItHint::CreateInsertion(InsertionLoc: LHSDeclRef->getBeginLoc(), Code: "this->");
14933 else
14934 D << 0;
14935 return;
14936 }
14937
14938 // Member variables require a different approach to check for self moves.
14939 // MemberExpr's are the same if every nested MemberExpr refers to the same
14940 // Decl and that the base Expr's are DeclRefExpr's with the same Decl or
14941 // the base Expr's are CXXThisExpr's.
14942 const Expr *LHSBase = LHSExpr;
14943 const Expr *RHSBase = RHSExpr;
14944 const MemberExpr *LHSME = dyn_cast<MemberExpr>(Val: LHSExpr);
14945 const MemberExpr *RHSME = dyn_cast<MemberExpr>(Val: RHSExpr);
14946 if (!LHSME || !RHSME)
14947 return;
14948
14949 while (LHSME && RHSME) {
14950 if (LHSME->getMemberDecl()->getCanonicalDecl() !=
14951 RHSME->getMemberDecl()->getCanonicalDecl())
14952 return;
14953
14954 LHSBase = LHSME->getBase();
14955 RHSBase = RHSME->getBase();
14956 LHSME = dyn_cast<MemberExpr>(Val: LHSBase);
14957 RHSME = dyn_cast<MemberExpr>(Val: RHSBase);
14958 }
14959
14960 LHSDeclRef = dyn_cast<DeclRefExpr>(Val: LHSBase);
14961 RHSDeclRef = dyn_cast<DeclRefExpr>(Val: RHSBase);
14962 if (LHSDeclRef && RHSDeclRef) {
14963 if (!LHSDeclRef->getDecl() || !RHSDeclRef->getDecl())
14964 return;
14965 if (LHSDeclRef->getDecl()->getCanonicalDecl() !=
14966 RHSDeclRef->getDecl()->getCanonicalDecl())
14967 return;
14968
14969 Diag(OpLoc, diag::warn_self_move)
14970 << LHSExpr->getType() << 0 << LHSExpr->getSourceRange()
14971 << RHSExpr->getSourceRange();
14972 return;
14973 }
14974
14975 if (isa<CXXThisExpr>(LHSBase) && isa<CXXThisExpr>(RHSBase))
14976 Diag(OpLoc, diag::warn_self_move)
14977 << LHSExpr->getType() << 0 << LHSExpr->getSourceRange()
14978 << RHSExpr->getSourceRange();
14979}
14980
14981//===--- Layout compatibility ----------------------------------------------//
14982
14983static bool isLayoutCompatible(const ASTContext &C, QualType T1, QualType T2);
14984
14985/// Check if two enumeration types are layout-compatible.
14986static bool isLayoutCompatible(const ASTContext &C, const EnumDecl *ED1,
14987 const EnumDecl *ED2) {
14988 // C++11 [dcl.enum] p8:
14989 // Two enumeration types are layout-compatible if they have the same
14990 // underlying type.
14991 return ED1->isComplete() && ED2->isComplete() &&
14992 C.hasSameType(T1: ED1->getIntegerType(), T2: ED2->getIntegerType());
14993}
14994
14995/// Check if two fields are layout-compatible.
14996/// Can be used on union members, which are exempt from alignment requirement
14997/// of common initial sequence.
14998static bool isLayoutCompatible(const ASTContext &C, const FieldDecl *Field1,
14999 const FieldDecl *Field2,
15000 bool AreUnionMembers = false) {
15001 [[maybe_unused]] const Type *Field1Parent =
15002 Field1->getParent()->getTypeForDecl();
15003 [[maybe_unused]] const Type *Field2Parent =
15004 Field2->getParent()->getTypeForDecl();
15005 assert(((Field1Parent->isStructureOrClassType() &&
15006 Field2Parent->isStructureOrClassType()) ||
15007 (Field1Parent->isUnionType() && Field2Parent->isUnionType())) &&
15008 "Can't evaluate layout compatibility between a struct field and a "
15009 "union field.");
15010 assert(((!AreUnionMembers && Field1Parent->isStructureOrClassType()) ||
15011 (AreUnionMembers && Field1Parent->isUnionType())) &&
15012 "AreUnionMembers should be 'true' for union fields (only).");
15013
15014 if (!isLayoutCompatible(C, Field1->getType(), Field2->getType()))
15015 return false;
15016
15017 if (Field1->isBitField() != Field2->isBitField())
15018 return false;
15019
15020 if (Field1->isBitField()) {
15021 // Make sure that the bit-fields are the same length.
15022 unsigned Bits1 = Field1->getBitWidthValue();
15023 unsigned Bits2 = Field2->getBitWidthValue();
15024
15025 if (Bits1 != Bits2)
15026 return false;
15027 }
15028
15029 if (Field1->hasAttr<clang::NoUniqueAddressAttr>() ||
15030 Field2->hasAttr<clang::NoUniqueAddressAttr>())
15031 return false;
15032
15033 if (!AreUnionMembers &&
15034 Field1->getMaxAlignment() != Field2->getMaxAlignment())
15035 return false;
15036
15037 return true;
15038}
15039
15040/// Check if two standard-layout structs are layout-compatible.
15041/// (C++11 [class.mem] p17)
15042static bool isLayoutCompatibleStruct(const ASTContext &C, const RecordDecl *RD1,
15043 const RecordDecl *RD2) {
15044 // Get to the class where the fields are declared
15045 if (const CXXRecordDecl *D1CXX = dyn_cast<CXXRecordDecl>(Val: RD1))
15046 RD1 = D1CXX->getStandardLayoutBaseWithFields();
15047
15048 if (const CXXRecordDecl *D2CXX = dyn_cast<CXXRecordDecl>(Val: RD2))
15049 RD2 = D2CXX->getStandardLayoutBaseWithFields();
15050
15051 // Check the fields.
15052 return llvm::equal(LRange: RD1->fields(), RRange: RD2->fields(),
15053 P: [&C](const FieldDecl *F1, const FieldDecl *F2) -> bool {
15054 return isLayoutCompatible(C, Field1: F1, Field2: F2);
15055 });
15056}
15057
15058/// Check if two standard-layout unions are layout-compatible.
15059/// (C++11 [class.mem] p18)
15060static bool isLayoutCompatibleUnion(const ASTContext &C, const RecordDecl *RD1,
15061 const RecordDecl *RD2) {
15062 llvm::SmallPtrSet<const FieldDecl *, 8> UnmatchedFields(llvm::from_range,
15063 RD2->fields());
15064
15065 for (auto *Field1 : RD1->fields()) {
15066 auto I = UnmatchedFields.begin();
15067 auto E = UnmatchedFields.end();
15068
15069 for ( ; I != E; ++I) {
15070 if (isLayoutCompatible(C, Field1, Field2: *I, /*IsUnionMember=*/AreUnionMembers: true)) {
15071 bool Result = UnmatchedFields.erase(Ptr: *I);
15072 (void) Result;
15073 assert(Result);
15074 break;
15075 }
15076 }
15077 if (I == E)
15078 return false;
15079 }
15080
15081 return UnmatchedFields.empty();
15082}
15083
15084static bool isLayoutCompatible(const ASTContext &C, const RecordDecl *RD1,
15085 const RecordDecl *RD2) {
15086 if (RD1->isUnion() != RD2->isUnion())
15087 return false;
15088
15089 if (RD1->isUnion())
15090 return isLayoutCompatibleUnion(C, RD1, RD2);
15091 else
15092 return isLayoutCompatibleStruct(C, RD1, RD2);
15093}
15094
15095/// Check if two types are layout-compatible in C++11 sense.
15096static bool isLayoutCompatible(const ASTContext &C, QualType T1, QualType T2) {
15097 if (T1.isNull() || T2.isNull())
15098 return false;
15099
15100 // C++20 [basic.types] p11:
15101 // Two types cv1 T1 and cv2 T2 are layout-compatible types
15102 // if T1 and T2 are the same type, layout-compatible enumerations (9.7.1),
15103 // or layout-compatible standard-layout class types (11.4).
15104 T1 = T1.getCanonicalType().getUnqualifiedType();
15105 T2 = T2.getCanonicalType().getUnqualifiedType();
15106
15107 if (C.hasSameType(T1, T2))
15108 return true;
15109
15110 const Type::TypeClass TC1 = T1->getTypeClass();
15111 const Type::TypeClass TC2 = T2->getTypeClass();
15112
15113 if (TC1 != TC2)
15114 return false;
15115
15116 if (TC1 == Type::Enum) {
15117 return isLayoutCompatible(C,
15118 ED1: cast<EnumType>(Val&: T1)->getDecl(),
15119 ED2: cast<EnumType>(Val&: T2)->getDecl());
15120 } else if (TC1 == Type::Record) {
15121 if (!T1->isStandardLayoutType() || !T2->isStandardLayoutType())
15122 return false;
15123
15124 return isLayoutCompatible(C,
15125 RD1: cast<RecordType>(Val&: T1)->getDecl(),
15126 RD2: cast<RecordType>(Val&: T2)->getDecl());
15127 }
15128
15129 return false;
15130}
15131
15132bool Sema::IsLayoutCompatible(QualType T1, QualType T2) const {
15133 return isLayoutCompatible(C: getASTContext(), T1, T2);
15134}
15135
15136//===-------------- Pointer interconvertibility ----------------------------//
15137
15138bool Sema::IsPointerInterconvertibleBaseOf(const TypeSourceInfo *Base,
15139 const TypeSourceInfo *Derived) {
15140 QualType BaseT = Base->getType()->getCanonicalTypeUnqualified();
15141 QualType DerivedT = Derived->getType()->getCanonicalTypeUnqualified();
15142
15143 if (BaseT->isStructureOrClassType() && DerivedT->isStructureOrClassType() &&
15144 getASTContext().hasSameType(T1: BaseT, T2: DerivedT))
15145 return true;
15146
15147 if (!IsDerivedFrom(Loc: Derived->getTypeLoc().getBeginLoc(), Derived: DerivedT, Base: BaseT))
15148 return false;
15149
15150 // Per [basic.compound]/4.3, containing object has to be standard-layout.
15151 if (DerivedT->getAsCXXRecordDecl()->isStandardLayout())
15152 return true;
15153
15154 return false;
15155}
15156
15157//===--- CHECK: pointer_with_type_tag attribute: datatypes should match ----//
15158
15159/// Given a type tag expression find the type tag itself.
15160///
15161/// \param TypeExpr Type tag expression, as it appears in user's code.
15162///
15163/// \param VD Declaration of an identifier that appears in a type tag.
15164///
15165/// \param MagicValue Type tag magic value.
15166///
15167/// \param isConstantEvaluated whether the evalaution should be performed in
15168
15169/// constant context.
15170static bool FindTypeTagExpr(const Expr *TypeExpr, const ASTContext &Ctx,
15171 const ValueDecl **VD, uint64_t *MagicValue,
15172 bool isConstantEvaluated) {
15173 while(true) {
15174 if (!TypeExpr)
15175 return false;
15176
15177 TypeExpr = TypeExpr->IgnoreParenImpCasts()->IgnoreParenCasts();
15178
15179 switch (TypeExpr->getStmtClass()) {
15180 case Stmt::UnaryOperatorClass: {
15181 const UnaryOperator *UO = cast<UnaryOperator>(Val: TypeExpr);
15182 if (UO->getOpcode() == UO_AddrOf || UO->getOpcode() == UO_Deref) {
15183 TypeExpr = UO->getSubExpr();
15184 continue;
15185 }
15186 return false;
15187 }
15188
15189 case Stmt::DeclRefExprClass: {
15190 const DeclRefExpr *DRE = cast<DeclRefExpr>(Val: TypeExpr);
15191 *VD = DRE->getDecl();
15192 return true;
15193 }
15194
15195 case Stmt::IntegerLiteralClass: {
15196 const IntegerLiteral *IL = cast<IntegerLiteral>(Val: TypeExpr);
15197 llvm::APInt MagicValueAPInt = IL->getValue();
15198 if (MagicValueAPInt.getActiveBits() <= 64) {
15199 *MagicValue = MagicValueAPInt.getZExtValue();
15200 return true;
15201 } else
15202 return false;
15203 }
15204
15205 case Stmt::BinaryConditionalOperatorClass:
15206 case Stmt::ConditionalOperatorClass: {
15207 const AbstractConditionalOperator *ACO =
15208 cast<AbstractConditionalOperator>(Val: TypeExpr);
15209 bool Result;
15210 if (ACO->getCond()->EvaluateAsBooleanCondition(Result, Ctx,
15211 InConstantContext: isConstantEvaluated)) {
15212 if (Result)
15213 TypeExpr = ACO->getTrueExpr();
15214 else
15215 TypeExpr = ACO->getFalseExpr();
15216 continue;
15217 }
15218 return false;
15219 }
15220
15221 case Stmt::BinaryOperatorClass: {
15222 const BinaryOperator *BO = cast<BinaryOperator>(Val: TypeExpr);
15223 if (BO->getOpcode() == BO_Comma) {
15224 TypeExpr = BO->getRHS();
15225 continue;
15226 }
15227 return false;
15228 }
15229
15230 default:
15231 return false;
15232 }
15233 }
15234}
15235
15236/// Retrieve the C type corresponding to type tag TypeExpr.
15237///
15238/// \param TypeExpr Expression that specifies a type tag.
15239///
15240/// \param MagicValues Registered magic values.
15241///
15242/// \param FoundWrongKind Set to true if a type tag was found, but of a wrong
15243/// kind.
15244///
15245/// \param TypeInfo Information about the corresponding C type.
15246///
15247/// \param isConstantEvaluated whether the evalaution should be performed in
15248/// constant context.
15249///
15250/// \returns true if the corresponding C type was found.
15251static bool GetMatchingCType(
15252 const IdentifierInfo *ArgumentKind, const Expr *TypeExpr,
15253 const ASTContext &Ctx,
15254 const llvm::DenseMap<Sema::TypeTagMagicValue, Sema::TypeTagData>
15255 *MagicValues,
15256 bool &FoundWrongKind, Sema::TypeTagData &TypeInfo,
15257 bool isConstantEvaluated) {
15258 FoundWrongKind = false;
15259
15260 // Variable declaration that has type_tag_for_datatype attribute.
15261 const ValueDecl *VD = nullptr;
15262
15263 uint64_t MagicValue;
15264
15265 if (!FindTypeTagExpr(TypeExpr, Ctx, VD: &VD, MagicValue: &MagicValue, isConstantEvaluated))
15266 return false;
15267
15268 if (VD) {
15269 if (TypeTagForDatatypeAttr *I = VD->getAttr<TypeTagForDatatypeAttr>()) {
15270 if (I->getArgumentKind() != ArgumentKind) {
15271 FoundWrongKind = true;
15272 return false;
15273 }
15274 TypeInfo.Type = I->getMatchingCType();
15275 TypeInfo.LayoutCompatible = I->getLayoutCompatible();
15276 TypeInfo.MustBeNull = I->getMustBeNull();
15277 return true;
15278 }
15279 return false;
15280 }
15281
15282 if (!MagicValues)
15283 return false;
15284
15285 llvm::DenseMap<Sema::TypeTagMagicValue,
15286 Sema::TypeTagData>::const_iterator I =
15287 MagicValues->find(Val: std::make_pair(x&: ArgumentKind, y&: MagicValue));
15288 if (I == MagicValues->end())
15289 return false;
15290
15291 TypeInfo = I->second;
15292 return true;
15293}
15294
15295void Sema::RegisterTypeTagForDatatype(const IdentifierInfo *ArgumentKind,
15296 uint64_t MagicValue, QualType Type,
15297 bool LayoutCompatible,
15298 bool MustBeNull) {
15299 if (!TypeTagForDatatypeMagicValues)
15300 TypeTagForDatatypeMagicValues.reset(
15301 p: new llvm::DenseMap<TypeTagMagicValue, TypeTagData>);
15302
15303 TypeTagMagicValue Magic(ArgumentKind, MagicValue);
15304 (*TypeTagForDatatypeMagicValues)[Magic] =
15305 TypeTagData(Type, LayoutCompatible, MustBeNull);
15306}
15307
15308static bool IsSameCharType(QualType T1, QualType T2) {
15309 const BuiltinType *BT1 = T1->getAs<BuiltinType>();
15310 if (!BT1)
15311 return false;
15312
15313 const BuiltinType *BT2 = T2->getAs<BuiltinType>();
15314 if (!BT2)
15315 return false;
15316
15317 BuiltinType::Kind T1Kind = BT1->getKind();
15318 BuiltinType::Kind T2Kind = BT2->getKind();
15319
15320 return (T1Kind == BuiltinType::SChar && T2Kind == BuiltinType::Char_S) ||
15321 (T1Kind == BuiltinType::UChar && T2Kind == BuiltinType::Char_U) ||
15322 (T1Kind == BuiltinType::Char_U && T2Kind == BuiltinType::UChar) ||
15323 (T1Kind == BuiltinType::Char_S && T2Kind == BuiltinType::SChar);
15324}
15325
15326void Sema::CheckArgumentWithTypeTag(const ArgumentWithTypeTagAttr *Attr,
15327 const ArrayRef<const Expr *> ExprArgs,
15328 SourceLocation CallSiteLoc) {
15329 const IdentifierInfo *ArgumentKind = Attr->getArgumentKind();
15330 bool IsPointerAttr = Attr->getIsPointer();
15331
15332 // Retrieve the argument representing the 'type_tag'.
15333 unsigned TypeTagIdxAST = Attr->getTypeTagIdx().getASTIndex();
15334 if (TypeTagIdxAST >= ExprArgs.size()) {
15335 Diag(CallSiteLoc, diag::err_tag_index_out_of_range)
15336 << 0 << Attr->getTypeTagIdx().getSourceIndex();
15337 return;
15338 }
15339 const Expr *TypeTagExpr = ExprArgs[TypeTagIdxAST];
15340 bool FoundWrongKind;
15341 TypeTagData TypeInfo;
15342 if (!GetMatchingCType(ArgumentKind, TypeExpr: TypeTagExpr, Ctx: Context,
15343 MagicValues: TypeTagForDatatypeMagicValues.get(), FoundWrongKind,
15344 TypeInfo, isConstantEvaluated: isConstantEvaluatedContext())) {
15345 if (FoundWrongKind)
15346 Diag(TypeTagExpr->getExprLoc(),
15347 diag::warn_type_tag_for_datatype_wrong_kind)
15348 << TypeTagExpr->getSourceRange();
15349 return;
15350 }
15351
15352 // Retrieve the argument representing the 'arg_idx'.
15353 unsigned ArgumentIdxAST = Attr->getArgumentIdx().getASTIndex();
15354 if (ArgumentIdxAST >= ExprArgs.size()) {
15355 Diag(CallSiteLoc, diag::err_tag_index_out_of_range)
15356 << 1 << Attr->getArgumentIdx().getSourceIndex();
15357 return;
15358 }
15359 const Expr *ArgumentExpr = ExprArgs[ArgumentIdxAST];
15360 if (IsPointerAttr) {
15361 // Skip implicit cast of pointer to `void *' (as a function argument).
15362 if (const ImplicitCastExpr *ICE = dyn_cast<ImplicitCastExpr>(Val: ArgumentExpr))
15363 if (ICE->getType()->isVoidPointerType() &&
15364 ICE->getCastKind() == CK_BitCast)
15365 ArgumentExpr = ICE->getSubExpr();
15366 }
15367 QualType ArgumentType = ArgumentExpr->getType();
15368
15369 // Passing a `void*' pointer shouldn't trigger a warning.
15370 if (IsPointerAttr && ArgumentType->isVoidPointerType())
15371 return;
15372
15373 if (TypeInfo.MustBeNull) {
15374 // Type tag with matching void type requires a null pointer.
15375 if (!ArgumentExpr->isNullPointerConstant(Ctx&: Context,
15376 NPC: Expr::NPC_ValueDependentIsNotNull)) {
15377 Diag(ArgumentExpr->getExprLoc(),
15378 diag::warn_type_safety_null_pointer_required)
15379 << ArgumentKind->getName()
15380 << ArgumentExpr->getSourceRange()
15381 << TypeTagExpr->getSourceRange();
15382 }
15383 return;
15384 }
15385
15386 QualType RequiredType = TypeInfo.Type;
15387 if (IsPointerAttr)
15388 RequiredType = Context.getPointerType(T: RequiredType);
15389
15390 bool mismatch = false;
15391 if (!TypeInfo.LayoutCompatible) {
15392 mismatch = !Context.hasSameType(T1: ArgumentType, T2: RequiredType);
15393
15394 // C++11 [basic.fundamental] p1:
15395 // Plain char, signed char, and unsigned char are three distinct types.
15396 //
15397 // But we treat plain `char' as equivalent to `signed char' or `unsigned
15398 // char' depending on the current char signedness mode.
15399 if (mismatch)
15400 if ((IsPointerAttr && IsSameCharType(T1: ArgumentType->getPointeeType(),
15401 T2: RequiredType->getPointeeType())) ||
15402 (!IsPointerAttr && IsSameCharType(T1: ArgumentType, T2: RequiredType)))
15403 mismatch = false;
15404 } else
15405 if (IsPointerAttr)
15406 mismatch = !isLayoutCompatible(C: Context,
15407 T1: ArgumentType->getPointeeType(),
15408 T2: RequiredType->getPointeeType());
15409 else
15410 mismatch = !isLayoutCompatible(C: Context, T1: ArgumentType, T2: RequiredType);
15411
15412 if (mismatch)
15413 Diag(ArgumentExpr->getExprLoc(), diag::warn_type_safety_type_mismatch)
15414 << ArgumentType << ArgumentKind
15415 << TypeInfo.LayoutCompatible << RequiredType
15416 << ArgumentExpr->getSourceRange()
15417 << TypeTagExpr->getSourceRange();
15418}
15419
15420void Sema::AddPotentialMisalignedMembers(Expr *E, RecordDecl *RD, ValueDecl *MD,
15421 CharUnits Alignment) {
15422 MisalignedMembers.emplace_back(Args&: E, Args&: RD, Args&: MD, Args&: Alignment);
15423}
15424
15425void Sema::DiagnoseMisalignedMembers() {
15426 for (MisalignedMember &m : MisalignedMembers) {
15427 const NamedDecl *ND = m.RD;
15428 if (ND->getName().empty()) {
15429 if (const TypedefNameDecl *TD = m.RD->getTypedefNameForAnonDecl())
15430 ND = TD;
15431 }
15432 Diag(m.E->getBeginLoc(), diag::warn_taking_address_of_packed_member)
15433 << m.MD << ND << m.E->getSourceRange();
15434 }
15435 MisalignedMembers.clear();
15436}
15437
15438void Sema::DiscardMisalignedMemberAddress(const Type *T, Expr *E) {
15439 E = E->IgnoreParens();
15440 if (!T->isPointerType() && !T->isIntegerType() && !T->isDependentType())
15441 return;
15442 if (isa<UnaryOperator>(Val: E) &&
15443 cast<UnaryOperator>(Val: E)->getOpcode() == UO_AddrOf) {
15444 auto *Op = cast<UnaryOperator>(Val: E)->getSubExpr()->IgnoreParens();
15445 if (isa<MemberExpr>(Val: Op)) {
15446 auto *MA = llvm::find(Range&: MisalignedMembers, Val: MisalignedMember(Op));
15447 if (MA != MisalignedMembers.end() &&
15448 (T->isDependentType() || T->isIntegerType() ||
15449 (T->isPointerType() && (T->getPointeeType()->isIncompleteType() ||
15450 Context.getTypeAlignInChars(
15451 T: T->getPointeeType()) <= MA->Alignment))))
15452 MisalignedMembers.erase(CI: MA);
15453 }
15454 }
15455}
15456
15457void Sema::RefersToMemberWithReducedAlignment(
15458 Expr *E,
15459 llvm::function_ref<void(Expr *, RecordDecl *, FieldDecl *, CharUnits)>
15460 Action) {
15461 const auto *ME = dyn_cast<MemberExpr>(Val: E);
15462 if (!ME)
15463 return;
15464
15465 // No need to check expressions with an __unaligned-qualified type.
15466 if (E->getType().getQualifiers().hasUnaligned())
15467 return;
15468
15469 // For a chain of MemberExpr like "a.b.c.d" this list
15470 // will keep FieldDecl's like [d, c, b].
15471 SmallVector<FieldDecl *, 4> ReverseMemberChain;
15472 const MemberExpr *TopME = nullptr;
15473 bool AnyIsPacked = false;
15474 do {
15475 QualType BaseType = ME->getBase()->getType();
15476 if (BaseType->isDependentType())
15477 return;
15478 if (ME->isArrow())
15479 BaseType = BaseType->getPointeeType();
15480 RecordDecl *RD = BaseType->castAs<RecordType>()->getDecl();
15481 if (RD->isInvalidDecl())
15482 return;
15483
15484 ValueDecl *MD = ME->getMemberDecl();
15485 auto *FD = dyn_cast<FieldDecl>(Val: MD);
15486 // We do not care about non-data members.
15487 if (!FD || FD->isInvalidDecl())
15488 return;
15489
15490 AnyIsPacked =
15491 AnyIsPacked || (RD->hasAttr<PackedAttr>() || MD->hasAttr<PackedAttr>());
15492 ReverseMemberChain.push_back(Elt: FD);
15493
15494 TopME = ME;
15495 ME = dyn_cast<MemberExpr>(Val: ME->getBase()->IgnoreParens());
15496 } while (ME);
15497 assert(TopME && "We did not compute a topmost MemberExpr!");
15498
15499 // Not the scope of this diagnostic.
15500 if (!AnyIsPacked)
15501 return;
15502
15503 const Expr *TopBase = TopME->getBase()->IgnoreParenImpCasts();
15504 const auto *DRE = dyn_cast<DeclRefExpr>(Val: TopBase);
15505 // TODO: The innermost base of the member expression may be too complicated.
15506 // For now, just disregard these cases. This is left for future
15507 // improvement.
15508 if (!DRE && !isa<CXXThisExpr>(Val: TopBase))
15509 return;
15510
15511 // Alignment expected by the whole expression.
15512 CharUnits ExpectedAlignment = Context.getTypeAlignInChars(T: E->getType());
15513
15514 // No need to do anything else with this case.
15515 if (ExpectedAlignment.isOne())
15516 return;
15517
15518 // Synthesize offset of the whole access.
15519 CharUnits Offset;
15520 for (const FieldDecl *FD : llvm::reverse(C&: ReverseMemberChain))
15521 Offset += Context.toCharUnitsFromBits(BitSize: Context.getFieldOffset(FD));
15522
15523 // Compute the CompleteObjectAlignment as the alignment of the whole chain.
15524 CharUnits CompleteObjectAlignment = Context.getTypeAlignInChars(
15525 ReverseMemberChain.back()->getParent()->getTypeForDecl());
15526
15527 // The base expression of the innermost MemberExpr may give
15528 // stronger guarantees than the class containing the member.
15529 if (DRE && !TopME->isArrow()) {
15530 const ValueDecl *VD = DRE->getDecl();
15531 if (!VD->getType()->isReferenceType())
15532 CompleteObjectAlignment =
15533 std::max(a: CompleteObjectAlignment, b: Context.getDeclAlign(VD));
15534 }
15535
15536 // Check if the synthesized offset fulfills the alignment.
15537 if (Offset % ExpectedAlignment != 0 ||
15538 // It may fulfill the offset it but the effective alignment may still be
15539 // lower than the expected expression alignment.
15540 CompleteObjectAlignment < ExpectedAlignment) {
15541 // If this happens, we want to determine a sensible culprit of this.
15542 // Intuitively, watching the chain of member expressions from right to
15543 // left, we start with the required alignment (as required by the field
15544 // type) but some packed attribute in that chain has reduced the alignment.
15545 // It may happen that another packed structure increases it again. But if
15546 // we are here such increase has not been enough. So pointing the first
15547 // FieldDecl that either is packed or else its RecordDecl is,
15548 // seems reasonable.
15549 FieldDecl *FD = nullptr;
15550 CharUnits Alignment;
15551 for (FieldDecl *FDI : ReverseMemberChain) {
15552 if (FDI->hasAttr<PackedAttr>() ||
15553 FDI->getParent()->hasAttr<PackedAttr>()) {
15554 FD = FDI;
15555 Alignment = std::min(
15556 Context.getTypeAlignInChars(FD->getType()),
15557 Context.getTypeAlignInChars(FD->getParent()->getTypeForDecl()));
15558 break;
15559 }
15560 }
15561 assert(FD && "We did not find a packed FieldDecl!");
15562 Action(E, FD->getParent(), FD, Alignment);
15563 }
15564}
15565
15566void Sema::CheckAddressOfPackedMember(Expr *rhs) {
15567 using namespace std::placeholders;
15568
15569 RefersToMemberWithReducedAlignment(
15570 rhs, std::bind(f: &Sema::AddPotentialMisalignedMembers, args: std::ref(t&: *this), args: _1,
15571 args: _2, args: _3, args: _4));
15572}
15573
15574// Performs a similar job to Sema::UsualUnaryConversions, but without any
15575// implicit promotion of integral/enumeration types.
15576static ExprResult BuiltinVectorMathConversions(Sema &S, Expr *E) {
15577 // First, convert to an r-value.
15578 ExprResult Res = S.DefaultFunctionArrayLvalueConversion(E);
15579 if (Res.isInvalid())
15580 return ExprError();
15581
15582 // Promote floating-point types.
15583 return S.UsualUnaryFPConversions(E: Res.get());
15584}
15585
15586bool Sema::PrepareBuiltinElementwiseMathOneArgCall(
15587 CallExpr *TheCall, EltwiseBuiltinArgTyRestriction ArgTyRestr) {
15588 if (checkArgCount(Call: TheCall, DesiredArgCount: 1))
15589 return true;
15590
15591 ExprResult A = BuiltinVectorMathConversions(S&: *this, E: TheCall->getArg(Arg: 0));
15592 if (A.isInvalid())
15593 return true;
15594
15595 TheCall->setArg(Arg: 0, ArgExpr: A.get());
15596 QualType TyA = A.get()->getType();
15597
15598 if (checkMathBuiltinElementType(*this, A.get()->getBeginLoc(), TyA,
15599 ArgTyRestr, 1))
15600 return true;
15601
15602 TheCall->setType(TyA);
15603 return false;
15604}
15605
15606bool Sema::BuiltinElementwiseMath(CallExpr *TheCall,
15607 EltwiseBuiltinArgTyRestriction ArgTyRestr) {
15608 if (auto Res = BuiltinVectorMath(TheCall, ArgTyRestr); Res.has_value()) {
15609 TheCall->setType(*Res);
15610 return false;
15611 }
15612 return true;
15613}
15614
15615bool Sema::BuiltinVectorToScalarMath(CallExpr *TheCall) {
15616 std::optional<QualType> Res = BuiltinVectorMath(TheCall);
15617 if (!Res)
15618 return true;
15619
15620 if (auto *VecTy0 = (*Res)->getAs<VectorType>())
15621 TheCall->setType(VecTy0->getElementType());
15622 else
15623 TheCall->setType(*Res);
15624
15625 return false;
15626}
15627
15628static bool checkBuiltinVectorMathMixedEnums(Sema &S, Expr *LHS, Expr *RHS,
15629 SourceLocation Loc) {
15630 QualType L = LHS->getEnumCoercedType(Ctx: S.Context),
15631 R = RHS->getEnumCoercedType(Ctx: S.Context);
15632 if (L->isUnscopedEnumerationType() && R->isUnscopedEnumerationType() &&
15633 !S.Context.hasSameUnqualifiedType(T1: L, T2: R)) {
15634 return S.Diag(Loc, diag::err_conv_mixed_enum_types)
15635 << LHS->getSourceRange() << RHS->getSourceRange()
15636 << /*Arithmetic Between*/ 0 << L << R;
15637 }
15638 return false;
15639}
15640
15641std::optional<QualType>
15642Sema::BuiltinVectorMath(CallExpr *TheCall,
15643 EltwiseBuiltinArgTyRestriction ArgTyRestr) {
15644 if (checkArgCount(Call: TheCall, DesiredArgCount: 2))
15645 return std::nullopt;
15646
15647 if (checkBuiltinVectorMathMixedEnums(
15648 *this, TheCall->getArg(Arg: 0), TheCall->getArg(Arg: 1), TheCall->getExprLoc()))
15649 return std::nullopt;
15650
15651 Expr *Args[2];
15652 for (int I = 0; I < 2; ++I) {
15653 ExprResult Converted =
15654 BuiltinVectorMathConversions(S&: *this, E: TheCall->getArg(Arg: I));
15655 if (Converted.isInvalid())
15656 return std::nullopt;
15657 Args[I] = Converted.get();
15658 }
15659
15660 SourceLocation LocA = Args[0]->getBeginLoc();
15661 QualType TyA = Args[0]->getType();
15662 QualType TyB = Args[1]->getType();
15663
15664 if (checkMathBuiltinElementType(S&: *this, Loc: LocA, ArgTy: TyA, ArgTyRestr, ArgOrdinal: 1))
15665 return std::nullopt;
15666
15667 if (!Context.hasSameUnqualifiedType(T1: TyA, T2: TyB)) {
15668 Diag(LocA, diag::err_typecheck_call_different_arg_types) << TyA << TyB;
15669 return std::nullopt;
15670 }
15671
15672 TheCall->setArg(Arg: 0, ArgExpr: Args[0]);
15673 TheCall->setArg(Arg: 1, ArgExpr: Args[1]);
15674 return TyA;
15675}
15676
15677bool Sema::BuiltinElementwiseTernaryMath(
15678 CallExpr *TheCall, EltwiseBuiltinArgTyRestriction ArgTyRestr) {
15679 if (checkArgCount(Call: TheCall, DesiredArgCount: 3))
15680 return true;
15681
15682 SourceLocation Loc = TheCall->getExprLoc();
15683 if (checkBuiltinVectorMathMixedEnums(S&: *this, LHS: TheCall->getArg(Arg: 0),
15684 RHS: TheCall->getArg(Arg: 1), Loc) ||
15685 checkBuiltinVectorMathMixedEnums(S&: *this, LHS: TheCall->getArg(Arg: 1),
15686 RHS: TheCall->getArg(Arg: 2), Loc))
15687 return true;
15688
15689 Expr *Args[3];
15690 for (int I = 0; I < 3; ++I) {
15691 ExprResult Converted =
15692 BuiltinVectorMathConversions(S&: *this, E: TheCall->getArg(Arg: I));
15693 if (Converted.isInvalid())
15694 return true;
15695 Args[I] = Converted.get();
15696 }
15697
15698 int ArgOrdinal = 1;
15699 for (Expr *Arg : Args) {
15700 if (checkMathBuiltinElementType(*this, Arg->getBeginLoc(), Arg->getType(),
15701 ArgTyRestr, ArgOrdinal++))
15702 return true;
15703 }
15704
15705 for (int I = 1; I < 3; ++I) {
15706 if (Args[0]->getType().getCanonicalType() !=
15707 Args[I]->getType().getCanonicalType()) {
15708 return Diag(Args[0]->getBeginLoc(),
15709 diag::err_typecheck_call_different_arg_types)
15710 << Args[0]->getType() << Args[I]->getType();
15711 }
15712
15713 TheCall->setArg(Arg: I, ArgExpr: Args[I]);
15714 }
15715
15716 TheCall->setType(Args[0]->getType());
15717 return false;
15718}
15719
15720bool Sema::PrepareBuiltinReduceMathOneArgCall(CallExpr *TheCall) {
15721 if (checkArgCount(Call: TheCall, DesiredArgCount: 1))
15722 return true;
15723
15724 ExprResult A = UsualUnaryConversions(E: TheCall->getArg(Arg: 0));
15725 if (A.isInvalid())
15726 return true;
15727
15728 TheCall->setArg(Arg: 0, ArgExpr: A.get());
15729 return false;
15730}
15731
15732bool Sema::BuiltinNonDeterministicValue(CallExpr *TheCall) {
15733 if (checkArgCount(Call: TheCall, DesiredArgCount: 1))
15734 return true;
15735
15736 ExprResult Arg = TheCall->getArg(Arg: 0);
15737 QualType TyArg = Arg.get()->getType();
15738
15739 if (!TyArg->isBuiltinType() && !TyArg->isVectorType())
15740 return Diag(TheCall->getArg(0)->getBeginLoc(),
15741 diag::err_builtin_invalid_arg_type)
15742 << 1 << /* vector */ 2 << /* integer */ 1 << /* fp */ 1 << TyArg;
15743
15744 TheCall->setType(TyArg);
15745 return false;
15746}
15747
15748ExprResult Sema::BuiltinMatrixTranspose(CallExpr *TheCall,
15749 ExprResult CallResult) {
15750 if (checkArgCount(Call: TheCall, DesiredArgCount: 1))
15751 return ExprError();
15752
15753 ExprResult MatrixArg = DefaultLvalueConversion(E: TheCall->getArg(Arg: 0));
15754 if (MatrixArg.isInvalid())
15755 return MatrixArg;
15756 Expr *Matrix = MatrixArg.get();
15757
15758 auto *MType = Matrix->getType()->getAs<ConstantMatrixType>();
15759 if (!MType) {
15760 Diag(Matrix->getBeginLoc(), diag::err_builtin_invalid_arg_type)
15761 << 1 << /* matrix */ 3 << /* no int */ 0 << /* no fp */ 0
15762 << Matrix->getType();
15763 return ExprError();
15764 }
15765
15766 // Create returned matrix type by swapping rows and columns of the argument
15767 // matrix type.
15768 QualType ResultType = Context.getConstantMatrixType(
15769 ElementType: MType->getElementType(), NumRows: MType->getNumColumns(), NumColumns: MType->getNumRows());
15770
15771 // Change the return type to the type of the returned matrix.
15772 TheCall->setType(ResultType);
15773
15774 // Update call argument to use the possibly converted matrix argument.
15775 TheCall->setArg(Arg: 0, ArgExpr: Matrix);
15776 return CallResult;
15777}
15778
15779// Get and verify the matrix dimensions.
15780static std::optional<unsigned>
15781getAndVerifyMatrixDimension(Expr *Expr, StringRef Name, Sema &S) {
15782 SourceLocation ErrorPos;
15783 std::optional<llvm::APSInt> Value =
15784 Expr->getIntegerConstantExpr(Ctx: S.Context, Loc: &ErrorPos);
15785 if (!Value) {
15786 S.Diag(Expr->getBeginLoc(), diag::err_builtin_matrix_scalar_unsigned_arg)
15787 << Name;
15788 return {};
15789 }
15790 uint64_t Dim = Value->getZExtValue();
15791 if (!ConstantMatrixType::isDimensionValid(NumElements: Dim)) {
15792 S.Diag(Expr->getBeginLoc(), diag::err_builtin_matrix_invalid_dimension)
15793 << Name << ConstantMatrixType::getMaxElementsPerDimension();
15794 return {};
15795 }
15796 return Dim;
15797}
15798
15799ExprResult Sema::BuiltinMatrixColumnMajorLoad(CallExpr *TheCall,
15800 ExprResult CallResult) {
15801 if (!getLangOpts().MatrixTypes) {
15802 Diag(TheCall->getBeginLoc(), diag::err_builtin_matrix_disabled);
15803 return ExprError();
15804 }
15805
15806 if (checkArgCount(Call: TheCall, DesiredArgCount: 4))
15807 return ExprError();
15808
15809 unsigned PtrArgIdx = 0;
15810 Expr *PtrExpr = TheCall->getArg(Arg: PtrArgIdx);
15811 Expr *RowsExpr = TheCall->getArg(Arg: 1);
15812 Expr *ColumnsExpr = TheCall->getArg(Arg: 2);
15813 Expr *StrideExpr = TheCall->getArg(Arg: 3);
15814
15815 bool ArgError = false;
15816
15817 // Check pointer argument.
15818 {
15819 ExprResult PtrConv = DefaultFunctionArrayLvalueConversion(E: PtrExpr);
15820 if (PtrConv.isInvalid())
15821 return PtrConv;
15822 PtrExpr = PtrConv.get();
15823 TheCall->setArg(Arg: 0, ArgExpr: PtrExpr);
15824 if (PtrExpr->isTypeDependent()) {
15825 TheCall->setType(Context.DependentTy);
15826 return TheCall;
15827 }
15828 }
15829
15830 auto *PtrTy = PtrExpr->getType()->getAs<PointerType>();
15831 QualType ElementTy;
15832 if (!PtrTy) {
15833 Diag(PtrExpr->getBeginLoc(), diag::err_builtin_invalid_arg_type)
15834 << PtrArgIdx + 1 << 0 << /* pointer to element ty */ 5 << /* no fp */ 0
15835 << PtrExpr->getType();
15836 ArgError = true;
15837 } else {
15838 ElementTy = PtrTy->getPointeeType().getUnqualifiedType();
15839
15840 if (!ConstantMatrixType::isValidElementType(T: ElementTy)) {
15841 Diag(PtrExpr->getBeginLoc(), diag::err_builtin_invalid_arg_type)
15842 << PtrArgIdx + 1 << 0 << /* pointer to element ty */ 5
15843 << /* no fp */ 0 << PtrExpr->getType();
15844 ArgError = true;
15845 }
15846 }
15847
15848 // Apply default Lvalue conversions and convert the expression to size_t.
15849 auto ApplyArgumentConversions = [this](Expr *E) {
15850 ExprResult Conv = DefaultLvalueConversion(E);
15851 if (Conv.isInvalid())
15852 return Conv;
15853
15854 return tryConvertExprToType(E: Conv.get(), Ty: Context.getSizeType());
15855 };
15856
15857 // Apply conversion to row and column expressions.
15858 ExprResult RowsConv = ApplyArgumentConversions(RowsExpr);
15859 if (!RowsConv.isInvalid()) {
15860 RowsExpr = RowsConv.get();
15861 TheCall->setArg(Arg: 1, ArgExpr: RowsExpr);
15862 } else
15863 RowsExpr = nullptr;
15864
15865 ExprResult ColumnsConv = ApplyArgumentConversions(ColumnsExpr);
15866 if (!ColumnsConv.isInvalid()) {
15867 ColumnsExpr = ColumnsConv.get();
15868 TheCall->setArg(Arg: 2, ArgExpr: ColumnsExpr);
15869 } else
15870 ColumnsExpr = nullptr;
15871
15872 // If any part of the result matrix type is still pending, just use
15873 // Context.DependentTy, until all parts are resolved.
15874 if ((RowsExpr && RowsExpr->isTypeDependent()) ||
15875 (ColumnsExpr && ColumnsExpr->isTypeDependent())) {
15876 TheCall->setType(Context.DependentTy);
15877 return CallResult;
15878 }
15879
15880 // Check row and column dimensions.
15881 std::optional<unsigned> MaybeRows;
15882 if (RowsExpr)
15883 MaybeRows = getAndVerifyMatrixDimension(Expr: RowsExpr, Name: "row", S&: *this);
15884
15885 std::optional<unsigned> MaybeColumns;
15886 if (ColumnsExpr)
15887 MaybeColumns = getAndVerifyMatrixDimension(Expr: ColumnsExpr, Name: "column", S&: *this);
15888
15889 // Check stride argument.
15890 ExprResult StrideConv = ApplyArgumentConversions(StrideExpr);
15891 if (StrideConv.isInvalid())
15892 return ExprError();
15893 StrideExpr = StrideConv.get();
15894 TheCall->setArg(Arg: 3, ArgExpr: StrideExpr);
15895
15896 if (MaybeRows) {
15897 if (std::optional<llvm::APSInt> Value =
15898 StrideExpr->getIntegerConstantExpr(Ctx: Context)) {
15899 uint64_t Stride = Value->getZExtValue();
15900 if (Stride < *MaybeRows) {
15901 Diag(StrideExpr->getBeginLoc(),
15902 diag::err_builtin_matrix_stride_too_small);
15903 ArgError = true;
15904 }
15905 }
15906 }
15907
15908 if (ArgError || !MaybeRows || !MaybeColumns)
15909 return ExprError();
15910
15911 TheCall->setType(
15912 Context.getConstantMatrixType(ElementType: ElementTy, NumRows: *MaybeRows, NumColumns: *MaybeColumns));
15913 return CallResult;
15914}
15915
15916ExprResult Sema::BuiltinMatrixColumnMajorStore(CallExpr *TheCall,
15917 ExprResult CallResult) {
15918 if (checkArgCount(Call: TheCall, DesiredArgCount: 3))
15919 return ExprError();
15920
15921 unsigned PtrArgIdx = 1;
15922 Expr *MatrixExpr = TheCall->getArg(Arg: 0);
15923 Expr *PtrExpr = TheCall->getArg(Arg: PtrArgIdx);
15924 Expr *StrideExpr = TheCall->getArg(Arg: 2);
15925
15926 bool ArgError = false;
15927
15928 {
15929 ExprResult MatrixConv = DefaultLvalueConversion(E: MatrixExpr);
15930 if (MatrixConv.isInvalid())
15931 return MatrixConv;
15932 MatrixExpr = MatrixConv.get();
15933 TheCall->setArg(Arg: 0, ArgExpr: MatrixExpr);
15934 }
15935 if (MatrixExpr->isTypeDependent()) {
15936 TheCall->setType(Context.DependentTy);
15937 return TheCall;
15938 }
15939
15940 auto *MatrixTy = MatrixExpr->getType()->getAs<ConstantMatrixType>();
15941 if (!MatrixTy) {
15942 Diag(MatrixExpr->getBeginLoc(), diag::err_builtin_invalid_arg_type)
15943 << 1 << /* matrix ty */ 3 << 0 << 0 << MatrixExpr->getType();
15944 ArgError = true;
15945 }
15946
15947 {
15948 ExprResult PtrConv = DefaultFunctionArrayLvalueConversion(E: PtrExpr);
15949 if (PtrConv.isInvalid())
15950 return PtrConv;
15951 PtrExpr = PtrConv.get();
15952 TheCall->setArg(Arg: 1, ArgExpr: PtrExpr);
15953 if (PtrExpr->isTypeDependent()) {
15954 TheCall->setType(Context.DependentTy);
15955 return TheCall;
15956 }
15957 }
15958
15959 // Check pointer argument.
15960 auto *PtrTy = PtrExpr->getType()->getAs<PointerType>();
15961 if (!PtrTy) {
15962 Diag(PtrExpr->getBeginLoc(), diag::err_builtin_invalid_arg_type)
15963 << PtrArgIdx + 1 << 0 << /* pointer to element ty */ 5 << 0
15964 << PtrExpr->getType();
15965 ArgError = true;
15966 } else {
15967 QualType ElementTy = PtrTy->getPointeeType();
15968 if (ElementTy.isConstQualified()) {
15969 Diag(PtrExpr->getBeginLoc(), diag::err_builtin_matrix_store_to_const);
15970 ArgError = true;
15971 }
15972 ElementTy = ElementTy.getUnqualifiedType().getCanonicalType();
15973 if (MatrixTy &&
15974 !Context.hasSameType(ElementTy, MatrixTy->getElementType())) {
15975 Diag(PtrExpr->getBeginLoc(),
15976 diag::err_builtin_matrix_pointer_arg_mismatch)
15977 << ElementTy << MatrixTy->getElementType();
15978 ArgError = true;
15979 }
15980 }
15981
15982 // Apply default Lvalue conversions and convert the stride expression to
15983 // size_t.
15984 {
15985 ExprResult StrideConv = DefaultLvalueConversion(E: StrideExpr);
15986 if (StrideConv.isInvalid())
15987 return StrideConv;
15988
15989 StrideConv = tryConvertExprToType(E: StrideConv.get(), Ty: Context.getSizeType());
15990 if (StrideConv.isInvalid())
15991 return StrideConv;
15992 StrideExpr = StrideConv.get();
15993 TheCall->setArg(Arg: 2, ArgExpr: StrideExpr);
15994 }
15995
15996 // Check stride argument.
15997 if (MatrixTy) {
15998 if (std::optional<llvm::APSInt> Value =
15999 StrideExpr->getIntegerConstantExpr(Ctx: Context)) {
16000 uint64_t Stride = Value->getZExtValue();
16001 if (Stride < MatrixTy->getNumRows()) {
16002 Diag(StrideExpr->getBeginLoc(),
16003 diag::err_builtin_matrix_stride_too_small);
16004 ArgError = true;
16005 }
16006 }
16007 }
16008
16009 if (ArgError)
16010 return ExprError();
16011
16012 return CallResult;
16013}
16014
16015void Sema::CheckTCBEnforcement(const SourceLocation CallExprLoc,
16016 const NamedDecl *Callee) {
16017 // This warning does not make sense in code that has no runtime behavior.
16018 if (isUnevaluatedContext())
16019 return;
16020
16021 const NamedDecl *Caller = getCurFunctionOrMethodDecl();
16022
16023 if (!Caller || !Caller->hasAttr<EnforceTCBAttr>())
16024 return;
16025
16026 // Search through the enforce_tcb and enforce_tcb_leaf attributes to find
16027 // all TCBs the callee is a part of.
16028 llvm::StringSet<> CalleeTCBs;
16029 for (const auto *A : Callee->specific_attrs<EnforceTCBAttr>())
16030 CalleeTCBs.insert(A->getTCBName());
16031 for (const auto *A : Callee->specific_attrs<EnforceTCBLeafAttr>())
16032 CalleeTCBs.insert(A->getTCBName());
16033
16034 // Go through the TCBs the caller is a part of and emit warnings if Caller
16035 // is in a TCB that the Callee is not.
16036 for (const auto *A : Caller->specific_attrs<EnforceTCBAttr>()) {
16037 StringRef CallerTCB = A->getTCBName();
16038 if (CalleeTCBs.count(CallerTCB) == 0) {
16039 this->Diag(CallExprLoc, diag::warn_tcb_enforcement_violation)
16040 << Callee << CallerTCB;
16041 }
16042 }
16043}
16044

Provided by KDAB

Privacy Policy
Update your C++ knowledge – Modern C++11/14/17 Training
Find out more

source code of clang/lib/Sema/SemaChecking.cpp