mirror of
https://github.com/llvm/llvm-project.git
synced 2025-04-16 12:36:37 +00:00
527fcb8e5d
As my BSc thesis I've implemented a checker for std::variant and std::any, and in the following weeks I'll upload a revised version of them here. # Prelude @Szelethus and I sent out an email with our initial plans here: https://discourse.llvm.org/t/analyzer-new-checker-for-std-any-as-a-bsc-thesis/65613/2 We also created a stub checker patch here: https://reviews.llvm.org/D142354. Upon the recommendation of @haoNoQ , we explored an option where instead of writing a checker, we tried to improve on how the analyzer natively inlined the methods of std::variant and std::any. Our attempt is in this patch https://reviews.llvm.org/D145069, but in a nutshell, this is what happened: The analyzer was able to model much of what happened inside those classes, but our false positive suppression machinery erroneously suppressed it. After months of trying, we could not find a satisfying enhancement on the heuristic without introducing an allowlist/denylist of which functions to not suppress. As a result (and partly on the encouragement of @Xazax-hun) I wrote a dedicated checker! The advantage of the checker is that it is not dependent on the standard's implementation and won't put warnings in the standard library definitions. Also without the checker it would be difficult to create nice user-friendly warnings and NoteTags -- as per the standard's specification, the analysis is sinked by an exception, which we don't model well now. # Design ideas The working of the checker is straightforward: We find the creation of an std::variant instance, store the type of the variable we want to store in it, then save this type for the instance. When retrieving type from the instance we check what type we want to retrieve as, and compare it to the actual type. If the two don't march we emit an error. Distinguishing variants by instance (e.g. MemRegion *) is not the most optimal way. Other checkers, like MallocChecker uses a symbol-to-trait map instead of region-to-trait. The upside of using symbols (which would be the value of a variant, not the variant itself itself) is that the analyzer would take care of modeling copies, moves, invalidation, etc, out of the box. The problem is that for compound types, the analyzer doesn't create a symbol as a result of a constructor call that is fit for this job. MallocChecker in contrast manipulates simple pointers. My colleges and I considered the option of making adjustments directly to the memory model of the analyzer, but for the time being decided against it, and go with the bit more cumbersome, but immediately viable option of simply using MemRegions. # Current state and review plan This patch contains an already working checker that can find and report certain variant/any misuses, but still lands it in alpha. I plan to upload the rest of the checker in later patches. The full checker is also able to "follow" the symbolic value held by the std::variant and updates the program state whenever we assign the value stored in the variant. I have also built a library that is meant to model union-like types similar to variant, hence some functions being a bit more multipurpose then is immediately needed. I also intend to publish my std::any checker in a later commit. --------- Co-authored-by: Gabor Spaits <gabor.spaits@ericsson.com> Co-authored-by: Balazs Benics <benicsbalazs@gmail.com>
358 lines
10 KiB
C++
358 lines
10 KiB
C++
// RUN: %clang %s -std=c++17 -Xclang -verify --analyze \
|
|
// RUN: -Xclang -analyzer-checker=core \
|
|
// RUN: -Xclang -analyzer-checker=debug.ExprInspection \
|
|
// RUN: -Xclang -analyzer-checker=core,alpha.core.StdVariant
|
|
|
|
#include "Inputs/system-header-simulator-cxx.h"
|
|
|
|
class Foo{};
|
|
|
|
void clang_analyzer_warnIfReached();
|
|
void clang_analyzer_eval(int);
|
|
|
|
//helper functions
|
|
void changeVariantType(std::variant<int, char> &v) {
|
|
v = 25;
|
|
}
|
|
|
|
void changesToInt(std::variant<int, char> &v);
|
|
void changesToInt(std::variant<int, char> *v);
|
|
|
|
void cannotChangePtr(const std::variant<int, char> &v);
|
|
void cannotChangePtr(const std::variant<int, char> *v);
|
|
|
|
char getUnknownChar();
|
|
|
|
void swap(std::variant<int, char> &v1, std::variant<int, char> &v2) {
|
|
std::variant<int, char> tmp = v1;
|
|
v1 = v2;
|
|
v2 = tmp;
|
|
}
|
|
|
|
void cantDo(const std::variant<int, char>& v) {
|
|
std::variant<int, char> vtmp = v;
|
|
vtmp = 5;
|
|
int a = std::get<int> (vtmp);
|
|
(void) a;
|
|
}
|
|
|
|
void changeVariantPtr(std::variant<int, char> *v) {
|
|
*v = 'c';
|
|
}
|
|
|
|
using var_t = std::variant<int, char>;
|
|
using var_tt = var_t;
|
|
using int_t = int;
|
|
using char_t = char;
|
|
|
|
// A quick sanity check to see that std::variant's std::get
|
|
// is not being confused with std::pairs std::get.
|
|
void wontConfuseStdGets() {
|
|
std::pair<int, char> p{15, '1'};
|
|
int a = std::get<int>(p);
|
|
char c = std::get<char>(p);
|
|
(void)a;
|
|
(void)c;
|
|
}
|
|
|
|
//----------------------------------------------------------------------------//
|
|
// std::get
|
|
//----------------------------------------------------------------------------//
|
|
void stdGetType() {
|
|
std::variant<int, char> v = 25;
|
|
int a = std::get<int>(v);
|
|
char c = std::get<char>(v); // expected-warning {{std::variant 'v' held an 'int', not a 'char'}}
|
|
(void)a;
|
|
(void)c;
|
|
}
|
|
|
|
void stdGetPointer() {
|
|
int *p = new int;
|
|
std::variant<int*, char> v = p;
|
|
int *a = std::get<int*>(v);
|
|
char c = std::get<char>(v); // expected-warning {{std::variant 'v' held an 'int *', not a 'char'}}
|
|
(void)a;
|
|
(void)c;
|
|
delete p;
|
|
}
|
|
|
|
void stdGetObject() {
|
|
std::variant<int, char, Foo> v = Foo{};
|
|
Foo f = std::get<Foo>(v);
|
|
int i = std::get<int>(v); // expected-warning {{std::variant 'v' held a 'Foo', not an 'int'}}
|
|
(void)i;
|
|
}
|
|
|
|
void stdGetPointerAndPointee() {
|
|
int a = 5;
|
|
std::variant<int, int*> v = &a;
|
|
int *b = std::get<int*>(v);
|
|
int c = std::get<int>(v); // expected-warning {{std::variant 'v' held an 'int *', not an 'int'}}
|
|
(void)c;
|
|
(void)b;
|
|
}
|
|
|
|
void variantHoldingVariant() {
|
|
std::variant<std::variant<int, char>, std::variant<char, int>> v = std::variant<int,char>(25);
|
|
std::variant<int, char> v1 = std::get<std::variant<int,char>>(v);
|
|
std::variant<char, int> v2 = std::get<std::variant<char,int>>(v); // expected-warning {{std::variant 'v' held a 'std::variant<int, char>', not a 'class std::variant<char, int>'}}
|
|
}
|
|
|
|
//----------------------------------------------------------------------------//
|
|
// Constructors and assignments
|
|
//----------------------------------------------------------------------------//
|
|
void copyConstructor() {
|
|
std::variant<int, char> v = 25;
|
|
std::variant<int, char> t(v);
|
|
int a = std::get<int> (t);
|
|
char c = std::get<char> (t); // expected-warning {{std::variant 't' held an 'int', not a 'char'}}
|
|
(void)a;
|
|
(void)c;
|
|
}
|
|
|
|
void copyAssignmentOperator() {
|
|
std::variant<int, char> v = 25;
|
|
std::variant<int, char> t = 'c';
|
|
t = v;
|
|
int a = std::get<int> (t);
|
|
char c = std::get<char> (t); // expected-warning {{std::variant 't' held an 'int', not a 'char'}}
|
|
(void)a;
|
|
(void)c;
|
|
}
|
|
|
|
void assignmentOperator() {
|
|
std::variant<int, char> v = 25;
|
|
int a = std::get<int> (v);
|
|
(void)a;
|
|
v = 'c';
|
|
char c = std::get<char>(v);
|
|
a = std::get<int>(v); // expected-warning {{std::variant 'v' held a 'char', not an 'int'}}
|
|
(void)a;
|
|
(void)c;
|
|
}
|
|
|
|
void typeChangeThreeTimes() {
|
|
std::variant<int, char, float> v = 25;
|
|
int a = std::get<int> (v);
|
|
(void)a;
|
|
v = 'c';
|
|
char c = std::get<char>(v);
|
|
v = 25;
|
|
a = std::get<int>(v);
|
|
(void)a;
|
|
v = 1.25f;
|
|
float f = std::get<float>(v);
|
|
a = std::get<int>(v); // expected-warning {{std::variant 'v' held a 'float', not an 'int'}}
|
|
(void)a;
|
|
(void)c;
|
|
(void)f;
|
|
}
|
|
|
|
void defaultConstructor() {
|
|
std::variant<int, char> v;
|
|
int i = std::get<int>(v);
|
|
char c = std::get<char>(v); // expected-warning {{std::variant 'v' held an 'int', not a 'char'}}
|
|
(void)i;
|
|
(void)c;
|
|
}
|
|
|
|
// Verify that we handle temporary objects correctly
|
|
void temporaryObjectsConstructor() {
|
|
std::variant<int, char> v(std::variant<int, char>('c'));
|
|
char c = std::get<char>(v);
|
|
int a = std::get<int>(v); // expected-warning {{std::variant 'v' held a 'char', not an 'int'}}
|
|
(void)a;
|
|
(void)c;
|
|
}
|
|
|
|
void temporaryObjectsAssignment() {
|
|
std::variant<int, char> v = std::variant<int, char>('c');
|
|
char c = std::get<char>(v);
|
|
int a = std::get<int>(v); // expected-warning {{std::variant 'v' held a 'char', not an 'int'}}
|
|
(void)a;
|
|
(void)c;
|
|
}
|
|
|
|
// Verify that we handle pointer types correctly
|
|
void pointerTypeHeld() {
|
|
int *p = new int;
|
|
std::variant<int*, char> v = p;
|
|
int *a = std::get<int*>(v);
|
|
char c = std::get<char>(v); // expected-warning {{std::variant 'v' held an 'int *', not a 'char'}}
|
|
(void)a;
|
|
(void)c;
|
|
delete p;
|
|
}
|
|
|
|
std::variant<int, char> get_unknown_variant();
|
|
// Verify that the copy constructor is handles properly when the std::variant
|
|
// has no previously activated type and we copy an object of unknown value in it.
|
|
void copyFromUnknownVariant() {
|
|
std::variant<int, char> u = get_unknown_variant();
|
|
std::variant<int, char> v(u);
|
|
int a = std::get<int>(v); // no-waring
|
|
char c = std::get<char>(v); // no-warning
|
|
(void)a;
|
|
(void)c;
|
|
}
|
|
|
|
// Verify that the copy constructor is handles properly when the std::variant
|
|
// has previously activated type and we copy an object of unknown value in it.
|
|
void copyFromUnknownVariantBef() {
|
|
std::variant<int, char> v = 25;
|
|
std::variant<int, char> u = get_unknown_variant();
|
|
v = u;
|
|
int a = std::get<int>(v); // no-waring
|
|
char c = std::get<char>(v); // no-warning
|
|
(void)a;
|
|
(void)c;
|
|
}
|
|
|
|
//----------------------------------------------------------------------------//
|
|
// typedef
|
|
//----------------------------------------------------------------------------//
|
|
|
|
void typefdefedVariant() {
|
|
var_t v = 25;
|
|
int a = std::get<int>(v);
|
|
char c = std::get<char>(v); // expected-warning {{std::variant 'v' held an 'int', not a 'char'}}
|
|
(void)a;
|
|
(void)c;
|
|
}
|
|
|
|
void typedefedTypedfefedVariant() {
|
|
var_tt v = 25;
|
|
int a = std::get<int>(v);
|
|
char c = std::get<char>(v); // expected-warning {{std::variant 'v' held an 'int', not a 'char'}}
|
|
(void)a;
|
|
(void)c;
|
|
}
|
|
|
|
void typedefedGet() {
|
|
std::variant<char, int> v = 25;
|
|
int a = std::get<int_t>(v);
|
|
char c = std::get<char_t>(v); // expected-warning {{std::variant 'v' held an 'int', not a 'char'}}
|
|
(void)a;
|
|
(void)c;
|
|
}
|
|
|
|
void typedefedPack() {
|
|
std::variant<int_t, char_t> v = 25;
|
|
int a = std::get<int>(v);
|
|
char c = std::get<char>(v); // expected-warning {{std::variant 'v' held an 'int', not a 'char'}}
|
|
(void)a;
|
|
(void)c;
|
|
}
|
|
|
|
void fromVariable() {
|
|
char o = 'c';
|
|
std::variant<int, char> v(o);
|
|
char c = std::get<char>(v);
|
|
int a = std::get<int>(v); // expected-warning {{std::variant 'v' held a 'char', not an 'int'}}
|
|
(void)a;
|
|
(void)c;
|
|
}
|
|
|
|
void unknowValueButKnownType() {
|
|
char o = getUnknownChar();
|
|
std::variant<int, char> v(o);
|
|
char c = std::get<char>(v);
|
|
int a = std::get<int>(v); // expected-warning {{std::variant 'v' held a 'char', not an 'int'}}
|
|
(void)a;
|
|
(void)c;
|
|
}
|
|
|
|
void createPointer() {
|
|
std::variant<int, char> *v = new std::variant<int, char>(15);
|
|
int a = std::get<int>(*v);
|
|
char c = std::get<char>(*v); // expected-warning {{std::variant held an 'int', not a 'char'}}
|
|
(void)a;
|
|
(void)c;
|
|
delete v;
|
|
}
|
|
|
|
//----------------------------------------------------------------------------//
|
|
// Passing std::variants to functions
|
|
//----------------------------------------------------------------------------//
|
|
|
|
// Verifying that we are not invalidating the memory region of a variant if
|
|
// a non inlined or inlined function takes it as a constant reference or pointer
|
|
void constNonInlineRef() {
|
|
std::variant<int, char> v = 'c';
|
|
cannotChangePtr(v);
|
|
char c = std::get<char>(v);
|
|
int a = std::get<int>(v); // expected-warning {{std::variant 'v' held a 'char', not an 'int'}}
|
|
(void)a;
|
|
(void)c;
|
|
}
|
|
|
|
void contNonInlinePtr() {
|
|
std::variant<int, char> v = 'c';
|
|
cannotChangePtr(&v);
|
|
char c = std::get<char>(v);
|
|
int a = std::get<int>(v); // expected-warning {{std::variant 'v' held a 'char', not an 'int'}}
|
|
(void)a;
|
|
(void)c;
|
|
}
|
|
|
|
void copyInAFunction() {
|
|
std::variant<int, char> v = 'c';
|
|
cantDo(v);
|
|
char c = std::get<char>(v);
|
|
int a = std::get<int>(v); // expected-warning {{std::variant 'v' held a 'char', not an 'int'}}
|
|
(void)a;
|
|
(void)c;
|
|
|
|
}
|
|
|
|
// Verifying that we can keep track of the type stored in std::variant when
|
|
// it is passed to an inlined function as a reference or pointer
|
|
void changeThruPointers() {
|
|
std::variant<int, char> v = 15;
|
|
changeVariantPtr(&v);
|
|
char c = std::get<char> (v);
|
|
int a = std::get<int> (v); // expected-warning {{std::variant 'v' held a 'char', not an 'int'}}
|
|
(void)a;
|
|
(void)c;
|
|
}
|
|
|
|
void functionCallWithCopyAssignment() {
|
|
var_t v1 = 15;
|
|
var_t v2 = 'c';
|
|
swap(v1, v2);
|
|
int a = std::get<int> (v2);
|
|
(void)a;
|
|
char c = std::get<char> (v1);
|
|
a = std::get<int> (v1); // expected-warning {{std::variant 'v1' held a 'char', not an 'int'}}
|
|
(void)a;
|
|
(void)c;
|
|
}
|
|
|
|
void inlineFunctionCall() {
|
|
std::variant<int, char> v = 'c';
|
|
changeVariantType(v);
|
|
int a = std::get<int> (v);
|
|
char c = std::get<char> (v); // expected-warning {{std::variant 'v' held an 'int', not a 'char'}}
|
|
(void)a;
|
|
(void)c;
|
|
}
|
|
|
|
// Verifying that we invalidate the mem region of std::variant when it is
|
|
// passed as a non const reference or a pointer to a non inlined function.
|
|
void nonInlineFunctionCall() {
|
|
std::variant<int, char> v = 'c';
|
|
changesToInt(v);
|
|
int a = std::get<int> (v); // no-waring
|
|
char c = std::get<char> (v); // no-warning
|
|
(void)a;
|
|
(void)c;
|
|
}
|
|
|
|
void nonInlineFunctionCallPtr() {
|
|
std::variant<int, char> v = 'c';
|
|
changesToInt(&v);
|
|
int a = std::get<int> (v); // no-warning
|
|
char c = std::get<char> (v); // no-warning
|
|
(void)a;
|
|
(void)c;
|
|
} |