Teach -Wuninitialized to recognize __attribute__((analyzer_noreturn))

for halting the propagation of uninitialized value tracking along
a path.  Unlike __attribute__((noreturn)), this attribute (which
is used by clients of the static analyzer) can be used to annotate
functions that essentially never return, but in rare cares may be
allowed to return for (special) debugging purposes.  This attribute
has been shown in reducing false positives in the static analyzer
by pruning false postives, and is equally applicable here.

Handling this attribute in the CFG itself is another option, but
this is not something all clients (e.g., possibly -Wunreachable-code)
would want to see.

Addresses <rdar://problem/12281583>.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163681 91177308-0d34-0410-b5e6-96231b3b80d8

diff --git a/lib/Analysis/UninitializedValues.cpp b/lib/Analysis/UninitializedValues.cpp
index 858be4561cafa30f73c135480cb16ecdde96c994..47f2cf67c8e6d3b7c767e70858363b71ca115bcb 100644 (file)
--- a/lib/Analysis/UninitializedValues.cpp
+++ b/lib/Analysis/UninitializedValues.cpp
@@ -605,14 +605,26 @@ void TransferFunctions::VisitBlockExpr(BlockExpr *be) {
 }
 
 void TransferFunctions::VisitCallExpr(CallExpr *ce) {
-  // After a call to a function like setjmp or vfork, any variable which is
-  // initialized anywhere within this function may now be initialized. For now,
-  // just assume such a call initializes all variables.
-  // FIXME: Only mark variables as initialized if they have an initializer which
-  // is reachable from here.
-  Decl *Callee = ce->getCalleeDecl();
-  if (Callee && Callee->hasAttr<ReturnsTwiceAttr>())
-    vals.setAllScratchValues(Initialized);
+  if (Decl *Callee = ce->getCalleeDecl()) {
+    if (Callee->hasAttr<ReturnsTwiceAttr>()) {
+      // After a call to a function like setjmp or vfork, any variable which is
+      // initialized anywhere within this function may now be initialized. For
+      // now, just assume such a call initializes all variables.  FIXME: Only
+      // mark variables as initialized if they have an initializer which is
+      // reachable from here.
+      vals.setAllScratchValues(Initialized);
+    }
+    else if (Callee->hasAttr<AnalyzerNoReturnAttr>()) {
+      // Functions labeled like "analyzer_noreturn" are often used to denote
+      // "panic" functions that in special debug situations can still return,
+      // but for the most part should not be treated as returning.  This is a
+      // useful annotation borrowed from the static analyzer that is useful for
+      // suppressing branch-specific false positives when we call one of these
+      // functions but keep pretending the path continues (when in reality the
+      // user doesn't care).
+      vals.setAllScratchValues(Unknown);
+    }
+  }
 }
 
 void TransferFunctions::VisitDeclRefExpr(DeclRefExpr *dr) {

diff --git a/test/Sema/uninit-variables.c b/test/Sema/uninit-variables.c
index 634ae0dc42843155576842924ce1ef321be6153c..9e3dd9d2875be285edbea3c5319b29f9d97c43cf 100644 (file)
--- a/test/Sema/uninit-variables.c
+++ b/test/Sema/uninit-variables.c
@@ -508,3 +508,26 @@ int self_init_in_cond(int *p) {
   int n = ((p && (0 || 1)) && (n = *p)) ? n : -1; // ok
   return n;
 }
+
+void test_analyzer_noreturn_aux() __attribute__((analyzer_noreturn));
+
+void test_analyzer_noreturn(int y) {
+  int x; // expected-note {{initialize the variable 'x' to silence this warning}}
+  if (y) {
+    test_analyzer_noreturn_aux();
+       ++x; // no-warning
+  }
+  else {
+       ++x; // expected-warning {{variable 'x' is uninitialized when used here}}
+  }
+}
+void test_analyzer_noreturn_2(int y) {
+  int x;
+  if (y) {
+    test_analyzer_noreturn_aux();
+  }
+  else {
+       x = 1;
+  }
+  ++x; // no-warning
+}