From: Ted Kremenek <kremenek@apple.com>
Date: Wed, 12 Sep 2012 05:53:43 +0000 (+0000)
Subject: Teach -Wuninitialized to recognize __attribute__((analyzer_noreturn))
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=44ca53f34deb5efe9fc6f246781f66f1ed83eabc;p=clang

Teach -Wuninitialized to recognize __attribute__((analyzer_noreturn))
for halting the propagation of uninitialized value tracking along
a path.  Unlike __attribute__((noreturn)), this attribute (which
is used by clients of the static analyzer) can be used to annotate
functions that essentially never return, but in rare cares may be
allowed to return for (special) debugging purposes.  This attribute
has been shown in reducing false positives in the static analyzer
by pruning false postives, and is equally applicable here.

Handling this attribute in the CFG itself is another option, but
this is not something all clients (e.g., possibly -Wunreachable-code)
would want to see.

Addresses <rdar://problem/12281583>.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163681 91177308-0d34-0410-b5e6-96231b3b80d8
---

diff --git a/lib/Analysis/UninitializedValues.cpp b/lib/Analysis/UninitializedValues.cpp
index 858be4561c..47f2cf67c8 100644
--- a/lib/Analysis/UninitializedValues.cpp
+++ b/lib/Analysis/UninitializedValues.cpp
@@ -605,14 +605,26 @@ void TransferFunctions::VisitBlockExpr(BlockExpr *be) {
 }
 
 void TransferFunctions::VisitCallExpr(CallExpr *ce) {
-  // After a call to a function like setjmp or vfork, any variable which is
-  // initialized anywhere within this function may now be initialized. For now,
-  // just assume such a call initializes all variables.
-  // FIXME: Only mark variables as initialized if they have an initializer which
-  // is reachable from here.
-  Decl *Callee = ce->getCalleeDecl();
-  if (Callee && Callee->hasAttr<ReturnsTwiceAttr>())
-    vals.setAllScratchValues(Initialized);
+  if (Decl *Callee = ce->getCalleeDecl()) {
+    if (Callee->hasAttr<ReturnsTwiceAttr>()) {
+      // After a call to a function like setjmp or vfork, any variable which is
+      // initialized anywhere within this function may now be initialized. For
+      // now, just assume such a call initializes all variables.  FIXME: Only
+      // mark variables as initialized if they have an initializer which is
+      // reachable from here.
+      vals.setAllScratchValues(Initialized);
+    }
+    else if (Callee->hasAttr<AnalyzerNoReturnAttr>()) {
+      // Functions labeled like "analyzer_noreturn" are often used to denote
+      // "panic" functions that in special debug situations can still return,
+      // but for the most part should not be treated as returning.  This is a
+      // useful annotation borrowed from the static analyzer that is useful for
+      // suppressing branch-specific false positives when we call one of these
+      // functions but keep pretending the path continues (when in reality the
+      // user doesn't care).
+      vals.setAllScratchValues(Unknown);
+    }
+  }
 }
 
 void TransferFunctions::VisitDeclRefExpr(DeclRefExpr *dr) {
diff --git a/test/Sema/uninit-variables.c b/test/Sema/uninit-variables.c
index 634ae0dc42..9e3dd9d287 100644
--- a/test/Sema/uninit-variables.c
+++ b/test/Sema/uninit-variables.c
@@ -508,3 +508,26 @@ int self_init_in_cond(int *p) {
   int n = ((p && (0 || 1)) && (n = *p)) ? n : -1; // ok
   return n;
 }
+
+void test_analyzer_noreturn_aux() __attribute__((analyzer_noreturn));
+
+void test_analyzer_noreturn(int y) {
+  int x; // expected-note {{initialize the variable 'x' to silence this warning}}
+  if (y) {
+    test_analyzer_noreturn_aux();
+	++x; // no-warning
+  }
+  else {
+	++x; // expected-warning {{variable 'x' is uninitialized when used here}}
+  }
+}
+void test_analyzer_noreturn_2(int y) {
+  int x;
+  if (y) {
+    test_analyzer_noreturn_aux();
+  }
+  else {
+	x = 1;
+  }
+  ++x; // no-warning
+}