|
|
|
(*
|
|
|
|
* Copyright (c) 2013 - present Facebook, Inc.
|
|
|
|
* All rights reserved.
|
|
|
|
*
|
|
|
|
* This source code is licensed under the BSD style license found in the
|
|
|
|
* LICENSE file in the root directory of this source tree. An additional grant
|
|
|
|
* of patent rights can be found in the PATENTS file in the same directory.
|
|
|
|
*)
|
|
|
|
|
|
|
|
(** Eradicate NPEs. *)
|
|
|
|
|
|
|
|
module L = Logging
|
|
|
|
module F = Format
|
|
|
|
open Dataflow
|
|
|
|
|
|
|
|
(* ERADICATE CHECKER. TODOS:*)
|
|
|
|
(* 1) add support for constructors for anonymous inner classes (currently not checked) *)
|
|
|
|
|
|
|
|
(* print initial and final typestates *)
|
|
|
|
let verbose = Config.from_env_variable "ERADICATE_TYPINGS"
|
|
|
|
|
|
|
|
(* print step-by-step tracing information *)
|
|
|
|
let trace = Config.from_env_variable "ERADICATE_TRACE"
|
|
|
|
|
|
|
|
let check_field_initialization = true (* check that nonnullable fields are initialized in constructors *)
|
|
|
|
|
|
|
|
type parameters = TypeState.parameters
|
|
|
|
|
|
|
|
|
|
|
|
(** Type for a module that provides a main callback function *)
|
|
|
|
module type CallBackT =
|
|
|
|
sig
|
|
|
|
val callback : TypeCheck.checks -> Callbacks.proc_callback_args -> unit
|
|
|
|
end (* CallBackT *)
|
|
|
|
|
|
|
|
(** Extension to the type checker. *)
|
|
|
|
module type ExtensionT = sig
|
|
|
|
type extension
|
|
|
|
val ext : extension TypeState.ext
|
|
|
|
val update_payload : extension TypeState.t option -> Specs.payload -> Specs.payload
|
|
|
|
end
|
|
|
|
|
|
|
|
(** Create a module with the toplevel callback. *)
|
|
|
|
module MkCallback
|
|
|
|
(Extension : ExtensionT)
|
|
|
|
: CallBackT =
|
|
|
|
struct
|
|
|
|
(** Update the summary with stats from the checker. *)
|
|
|
|
let update_summary proc_name proc_desc final_typestate_opt =
|
|
|
|
match Specs.get_summary proc_name with
|
|
|
|
| Some old_summ ->
|
|
|
|
let nodes = IList.map (fun n -> Cfg.Node.get_id n) (Cfg.Procdesc.get_nodes proc_desc) in
|
|
|
|
let method_annotation =
|
|
|
|
(Specs.pdesc_resolve_attributes proc_desc).ProcAttributes.method_annotation in
|
|
|
|
let new_summ =
|
|
|
|
{
|
|
|
|
old_summ with
|
|
|
|
Specs.nodes = nodes;
|
|
|
|
Specs.payload =
|
|
|
|
Extension.update_payload final_typestate_opt old_summ.Specs.payload;
|
|
|
|
Specs.attributes =
|
|
|
|
{
|
|
|
|
old_summ.Specs.attributes with
|
|
|
|
ProcAttributes.loc = Cfg.Procdesc.get_loc proc_desc;
|
|
|
|
method_annotation;
|
|
|
|
};
|
|
|
|
} in
|
|
|
|
Specs.add_summary proc_name new_summ
|
|
|
|
| None -> ()
|
|
|
|
|
|
|
|
let callback1
|
|
|
|
find_canonical_duplicate calls_this checks get_proc_desc idenv curr_pname
|
|
|
|
curr_pdesc annotated_signature linereader proc_loc
|
|
|
|
: bool * Extension.extension TypeState.t option =
|
|
|
|
let mk_pvar s = Sil.mk_pvar s curr_pname in
|
|
|
|
let add_formal typestate (s, ia, typ) =
|
|
|
|
let pvar = mk_pvar s in
|
|
|
|
let ta =
|
|
|
|
let origin = TypeOrigin.Formal s in
|
|
|
|
TypeAnnotation.from_item_annotation ia origin in
|
|
|
|
TypeState.add_pvar pvar (typ, ta, []) typestate in
|
|
|
|
let get_initial_typestate () =
|
|
|
|
let typestate_empty = TypeState.empty Extension.ext in
|
|
|
|
IList.fold_left add_formal typestate_empty annotated_signature.Annotations.params in
|
|
|
|
|
|
|
|
(** Check the nullable flag computed for the return value and report inconsistencies. *)
|
|
|
|
let check_return find_canonical_duplicate exit_node final_typestate ret_ia ret_type loc : unit =
|
|
|
|
let ret_pvar = Cfg.Procdesc.get_ret_var curr_pdesc in
|
|
|
|
let ret_range = TypeState.lookup_pvar ret_pvar final_typestate in
|
|
|
|
let typ_found_opt = match ret_range with
|
|
|
|
| Some (typ_found, _, _) -> Some typ_found
|
|
|
|
| None -> None in
|
|
|
|
let ret_implicitly_nullable =
|
|
|
|
string_equal (PatternMatch.get_type_name ret_type) "java.lang.Void" in
|
|
|
|
State.set_node exit_node;
|
|
|
|
|
|
|
|
if checks.TypeCheck.check_ret_type <> [] then
|
|
|
|
IList.iter
|
|
|
|
(fun f -> f curr_pname curr_pdesc ret_type typ_found_opt loc)
|
|
|
|
checks.TypeCheck.check_ret_type;
|
|
|
|
if checks.TypeCheck.eradicate then
|
|
|
|
EradicateChecks.check_return_annotation
|
|
|
|
find_canonical_duplicate curr_pname exit_node ret_range
|
|
|
|
ret_ia ret_implicitly_nullable loc in
|
|
|
|
|
|
|
|
let do_before_dataflow initial_typestate =
|
|
|
|
if verbose then
|
|
|
|
L.stdout "Initial Typestate@\n%a@."
|
|
|
|
(TypeState.pp Extension.ext) initial_typestate in
|
|
|
|
|
|
|
|
let do_after_dataflow find_canonical_duplicate final_typestate =
|
|
|
|
let exit_node = Cfg.Procdesc.get_exit_node curr_pdesc in
|
|
|
|
let ia, ret_type = annotated_signature.Annotations.ret in
|
|
|
|
check_return find_canonical_duplicate exit_node final_typestate ia ret_type proc_loc in
|
|
|
|
|
|
|
|
let module DFTypeCheck = MakeDF(struct
|
|
|
|
type t = Extension.extension TypeState.t
|
|
|
|
let equal = TypeState.equal
|
|
|
|
let join = TypeState.join Extension.ext
|
|
|
|
let do_node node typestate =
|
|
|
|
State.set_node node;
|
|
|
|
let typestates_succ, typestates_exn =
|
|
|
|
TypeCheck.typecheck_node
|
|
|
|
Extension.ext calls_this checks idenv get_proc_desc curr_pname curr_pdesc
|
|
|
|
find_canonical_duplicate annotated_signature typestate node linereader in
|
|
|
|
if trace then
|
|
|
|
IList.iter (fun typestate_succ ->
|
|
|
|
L.stdout
|
|
|
|
"Typestate After Node %a@\n%a@."
|
|
|
|
Cfg.Node.pp node
|
|
|
|
(TypeState.pp Extension.ext) typestate_succ)
|
|
|
|
typestates_succ;
|
|
|
|
typestates_succ, typestates_exn
|
|
|
|
let proc_throws _ = DontKnow
|
|
|
|
end) in
|
|
|
|
let initial_typestate = get_initial_typestate () in
|
|
|
|
do_before_dataflow initial_typestate;
|
|
|
|
let transitions = DFTypeCheck.run curr_pdesc initial_typestate in
|
|
|
|
match transitions (Cfg.Procdesc.get_exit_node curr_pdesc) with
|
|
|
|
| DFTypeCheck.Transition (final_typestate, _, _) ->
|
|
|
|
do_after_dataflow find_canonical_duplicate final_typestate;
|
|
|
|
!calls_this, Some final_typestate
|
|
|
|
| DFTypeCheck.Dead_state ->
|
|
|
|
!calls_this, None
|
|
|
|
|
|
|
|
let callback2
|
|
|
|
calls_this checks
|
|
|
|
{
|
|
|
|
Callbacks.proc_desc = curr_pdesc;
|
|
|
|
proc_name = curr_pname;
|
|
|
|
get_proc_desc;
|
|
|
|
idenv;
|
|
|
|
tenv;
|
|
|
|
get_procs_in_file;
|
|
|
|
}
|
|
|
|
annotated_signature linereader proc_loc : unit =
|
|
|
|
|
|
|
|
let find_duplicate_nodes = State.mk_find_duplicate_nodes curr_pdesc in
|
|
|
|
let find_canonical_duplicate node =
|
|
|
|
let duplicate_nodes = find_duplicate_nodes node in
|
|
|
|
try Cfg.NodeSet.min_elt duplicate_nodes with
|
|
|
|
| Not_found -> node in
|
|
|
|
|
|
|
|
let typecheck_proc do_checks pname pdesc proc_details_opt =
|
|
|
|
let ann_sig, loc, idenv_pn = match proc_details_opt with
|
|
|
|
| Some (ann_sig, loc, idenv_pn) ->
|
|
|
|
(ann_sig, loc, idenv_pn)
|
|
|
|
| None ->
|
|
|
|
let ann_sig =
|
|
|
|
Models.get_modelled_annotated_signature (Cfg.Procdesc.get_attributes pdesc) in
|
|
|
|
let loc = Cfg.Procdesc.get_loc pdesc in
|
|
|
|
let idenv_pn = Idenv.create_from_idenv idenv pdesc in
|
|
|
|
(ann_sig, loc, idenv_pn) in
|
|
|
|
let checks', calls_this' =
|
|
|
|
if do_checks then checks, calls_this
|
|
|
|
else
|
|
|
|
{
|
|
|
|
TypeCheck.eradicate = false;
|
|
|
|
check_extension = false;
|
|
|
|
check_ret_type = [];
|
|
|
|
}, ref false in
|
|
|
|
callback1
|
|
|
|
find_canonical_duplicate calls_this' checks' get_proc_desc idenv_pn
|
|
|
|
pname pdesc ann_sig linereader loc in
|
|
|
|
|
|
|
|
let module Initializers = struct
|
|
|
|
type init = Procname.t * Cfg.Procdesc.t
|
|
|
|
|
|
|
|
let final_typestates initializers_current_class =
|
|
|
|
(** Get the private methods, from the same class, directly called by the initializers. *)
|
|
|
|
let get_private_called (initializers : init list) : init list =
|
|
|
|
let res = ref [] in
|
|
|
|
let do_proc (init_pn, init_pd) =
|
|
|
|
let filter callee_pn callee_attributes =
|
|
|
|
let is_private =
|
|
|
|
callee_attributes.ProcAttributes.access = Sil.Private in
|
|
|
|
let same_class =
|
|
|
|
let get_class_opt pn =
|
|
|
|
if Procname.is_java pn then Some (Procname.java_get_class pn)
|
|
|
|
else None in
|
|
|
|
get_class_opt init_pn = get_class_opt callee_pn in
|
|
|
|
is_private && same_class in
|
|
|
|
let private_called = PatternMatch.proc_calls
|
|
|
|
Specs.proc_resolve_attributes init_pd filter in
|
|
|
|
let do_called (callee_pn, _) =
|
|
|
|
match get_proc_desc callee_pn with
|
|
|
|
| Some callee_pd ->
|
|
|
|
res := (callee_pn, callee_pd) :: !res
|
|
|
|
| None -> () in
|
|
|
|
IList.iter do_called private_called in
|
|
|
|
IList.iter do_proc initializers;
|
|
|
|
!res in
|
|
|
|
|
|
|
|
(** Get the initializers recursively called by computing a fixpoint.
|
|
|
|
Start from the initializers of the current class and the current procedure. *)
|
|
|
|
let initializers_recursive : init list =
|
|
|
|
let initializers_base_case = initializers_current_class in
|
|
|
|
|
|
|
|
let res = ref [] in
|
|
|
|
let seen = ref Procname.Set.empty in
|
|
|
|
let mark_seen (initializers : init list) : unit =
|
|
|
|
IList.iter (fun (pn, _) -> seen := Procname.Set.add pn !seen) initializers;
|
|
|
|
res := !res @ initializers in
|
|
|
|
|
|
|
|
let rec fixpoint initializers_old =
|
|
|
|
let initializers_new = get_private_called initializers_old in
|
|
|
|
let initializers_new' =
|
|
|
|
IList.filter (fun (pn, _) -> not (Procname.Set.mem pn !seen)) initializers_new in
|
|
|
|
mark_seen initializers_new';
|
|
|
|
if initializers_new' <> [] then fixpoint initializers_new' in
|
|
|
|
|
|
|
|
mark_seen initializers_base_case;
|
|
|
|
fixpoint initializers_base_case;
|
|
|
|
!res in
|
|
|
|
|
|
|
|
(** Get the final typestates of all the initializers. *)
|
|
|
|
let final_typestates = ref [] in
|
|
|
|
let get_final_typestate (pname, pdesc) =
|
|
|
|
match typecheck_proc false pname pdesc None with
|
|
|
|
| _, Some final_typestate ->
|
|
|
|
final_typestates := (pname, final_typestate) :: !final_typestates
|
|
|
|
| _, None -> () in
|
|
|
|
IList.iter get_final_typestate initializers_recursive;
|
|
|
|
IList.rev !final_typestates
|
|
|
|
|
|
|
|
let pname_and_pdescs_with f =
|
|
|
|
let res = ref [] in
|
|
|
|
let filter pname = match Specs.proc_resolve_attributes pname with
|
|
|
|
| Some proc_attributes -> f (pname, proc_attributes)
|
|
|
|
| None -> false in
|
|
|
|
let do_proc pname =
|
|
|
|
if filter pname then
|
|
|
|
match get_proc_desc pname with
|
|
|
|
| Some pdesc ->
|
|
|
|
res := (pname, pdesc) :: !res
|
|
|
|
| None -> () in
|
|
|
|
IList.iter do_proc (get_procs_in_file curr_pname);
|
|
|
|
IList.rev !res
|
|
|
|
|
|
|
|
(** Typestates after the current procedure and all initializer procedures. *)
|
|
|
|
let final_initializer_typestates_lazy = lazy
|
|
|
|
begin
|
|
|
|
let is_initializer proc_attributes =
|
|
|
|
PatternMatch.method_is_initializer tenv proc_attributes ||
|
|
|
|
let ia, _ =
|
|
|
|
(Models.get_modelled_annotated_signature proc_attributes).Annotations.ret in
|
|
|
|
Annotations.ia_is_initializer ia in
|
|
|
|
let initializers_current_class =
|
|
|
|
pname_and_pdescs_with
|
|
|
|
(function (pname, proc_attributes) ->
|
|
|
|
is_initializer proc_attributes &&
|
|
|
|
Procname.java_get_class pname = Procname.java_get_class curr_pname) in
|
|
|
|
final_typestates
|
|
|
|
((curr_pname, curr_pdesc) :: initializers_current_class)
|
|
|
|
end
|
|
|
|
|
|
|
|
(** Typestates after all constructors. *)
|
|
|
|
let final_constructor_typestates_lazy = lazy
|
|
|
|
begin
|
|
|
|
let constructors_current_class =
|
|
|
|
pname_and_pdescs_with
|
|
|
|
(fun (pname, _) ->
|
|
|
|
Procname.is_constructor pname &&
|
|
|
|
Procname.java_get_class pname = Procname.java_get_class curr_pname) in
|
|
|
|
final_typestates constructors_current_class
|
|
|
|
end
|
|
|
|
|
|
|
|
end (* Initializers *) in
|
|
|
|
|
|
|
|
let do_final_typestate typestate_opt calls_this =
|
|
|
|
let do_typestate typestate =
|
|
|
|
let start_node = Cfg.Procdesc.get_start_node curr_pdesc in
|
|
|
|
if not calls_this && (* if 'this(...)' is called, no need to check initialization *)
|
|
|
|
check_field_initialization &&
|
|
|
|
checks.TypeCheck.eradicate
|
|
|
|
then begin
|
|
|
|
EradicateChecks.check_constructor_initialization
|
|
|
|
find_canonical_duplicate
|
|
|
|
curr_pname
|
|
|
|
curr_pdesc
|
|
|
|
start_node
|
|
|
|
Initializers.final_initializer_typestates_lazy
|
|
|
|
Initializers.final_constructor_typestates_lazy
|
|
|
|
proc_loc
|
|
|
|
end;
|
|
|
|
if verbose then
|
|
|
|
L.stdout "Final Typestate@\n%a@."
|
|
|
|
(TypeState.pp Extension.ext) typestate in
|
|
|
|
match typestate_opt with
|
|
|
|
| None -> ()
|
|
|
|
| Some typestate -> do_typestate typestate in
|
|
|
|
|
|
|
|
TypeErr.reset ();
|
|
|
|
|
|
|
|
let calls_this, final_typestate_opt =
|
|
|
|
typecheck_proc true curr_pname curr_pdesc (Some (annotated_signature, proc_loc, idenv)) in
|
|
|
|
do_final_typestate final_typestate_opt calls_this;
|
|
|
|
if checks.TypeCheck.eradicate then
|
|
|
|
EradicateChecks.check_overridden_annotations
|
|
|
|
find_canonical_duplicate
|
|
|
|
tenv curr_pname curr_pdesc
|
|
|
|
annotated_signature;
|
|
|
|
|
|
|
|
TypeErr.report_forall_checks_and_reset Checkers.ST.report_error curr_pname;
|
|
|
|
update_summary curr_pname curr_pdesc final_typestate_opt
|
|
|
|
|
|
|
|
(** Entry point for the eradicate-based checker infrastructure. *)
|
|
|
|
let callback checks ({ Callbacks.proc_desc; proc_name } as callback_args) =
|
|
|
|
let calls_this = ref false in
|
|
|
|
|
|
|
|
let filter_special_cases () =
|
|
|
|
if Procname.java_is_access_method proc_name ||
|
|
|
|
(Specs.pdesc_resolve_attributes proc_desc).ProcAttributes.is_bridge_method
|
|
|
|
then None
|
|
|
|
else
|
|
|
|
begin
|
|
|
|
let annotated_signature =
|
|
|
|
Models.get_modelled_annotated_signature (Specs.pdesc_resolve_attributes proc_desc) in
|
|
|
|
Some annotated_signature
|
|
|
|
end in
|
|
|
|
match filter_special_cases () with
|
|
|
|
| None -> ()
|
|
|
|
| Some annotated_signature ->
|
|
|
|
let loc = Cfg.Procdesc.get_loc proc_desc in
|
|
|
|
let linereader = Printer.LineReader.create () in
|
|
|
|
if verbose then
|
|
|
|
L.stdout "%a@."
|
|
|
|
(Annotations.pp_annotated_signature proc_name)
|
|
|
|
annotated_signature;
|
|
|
|
|
|
|
|
callback2
|
|
|
|
calls_this checks callback_args annotated_signature linereader loc
|
|
|
|
|
|
|
|
end (* MkCallback *)
|
|
|
|
|
|
|
|
(** Given an extension to the typestate with a check, call the check on each instruction. *)
|
|
|
|
module Build
|
|
|
|
(Extension : ExtensionT)
|
|
|
|
: CallBackT =
|
|
|
|
struct
|
|
|
|
module Callback = MkCallback(Extension)
|
|
|
|
let callback = Callback.callback
|
|
|
|
end (* Build *)
|
|
|
|
|
|
|
|
module EmptyExtension : ExtensionT =
|
|
|
|
struct
|
|
|
|
type extension = unit
|
|
|
|
let ext =
|
|
|
|
let empty = () in
|
|
|
|
let check_instr _ _ _ ext _ _ = ext in
|
|
|
|
let join () () = () in
|
|
|
|
let pp _ () = () in
|
|
|
|
{
|
|
|
|
TypeState.empty = empty;
|
|
|
|
check_instr = check_instr;
|
|
|
|
join = join;
|
|
|
|
pp = pp;
|
|
|
|
}
|
|
|
|
let update_payload typestate_opt payload =
|
|
|
|
{ payload with
|
|
|
|
Specs.typestate = typestate_opt; }
|
|
|
|
end
|
|
|
|
|
|
|
|
module Main =
|
|
|
|
Build(EmptyExtension)
|
|
|
|
|
|
|
|
(** Eradicate checker for Java @Nullable annotations. *)
|
|
|
|
let callback_eradicate
|
|
|
|
({ Callbacks.get_proc_desc; idenv; proc_name } as callback_args) =
|
|
|
|
let checks =
|
|
|
|
{
|
|
|
|
TypeCheck.eradicate = true;
|
|
|
|
check_extension = false;
|
|
|
|
check_ret_type = [];
|
|
|
|
} in
|
|
|
|
let callbacks =
|
|
|
|
let analyze_ondemand pdesc =
|
|
|
|
let idenv_pname = Idenv.create_from_idenv idenv pdesc in
|
|
|
|
Main.callback checks
|
|
|
|
{ callback_args with
|
|
|
|
Callbacks.idenv = idenv_pname;
|
|
|
|
proc_name = (Cfg.Procdesc.get_proc_name pdesc);
|
|
|
|
proc_desc = pdesc; } in
|
|
|
|
{
|
|
|
|
Ondemand.analyze_ondemand;
|
|
|
|
get_proc_desc;
|
|
|
|
} in
|
|
|
|
|
|
|
|
if Ondemand.procedure_should_be_analyzed proc_name
|
|
|
|
then
|
|
|
|
begin
|
|
|
|
Ondemand.set_callbacks callbacks;
|
|
|
|
Main.callback checks callback_args;
|
|
|
|
Ondemand.unset_callbacks ()
|
|
|
|
end
|
|
|
|
|
|
|
|
(** Call the given check_return_type at the end of every procedure. *)
|
|
|
|
let callback_check_return_type check_return_type callback_args =
|
|
|
|
let checks =
|
|
|
|
{
|
|
|
|
TypeCheck.eradicate = false;
|
|
|
|
check_extension = false;
|
|
|
|
check_ret_type = [check_return_type];
|
|
|
|
} in
|
|
|
|
Main.callback checks callback_args
|