clang  5.0.0
BuiltinFunctionChecker.cpp
Go to the documentation of this file.
1 //=== BuiltinFunctionChecker.cpp --------------------------------*- C++ -*-===//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This checker evaluates clang builtin functions.
11 //
12 //===----------------------------------------------------------------------===//
13 
14 #include "ClangSACheckers.h"
15 #include "clang/Basic/Builtins.h"
19 
20 using namespace clang;
21 using namespace ento;
22 
23 namespace {
24 
25 class BuiltinFunctionChecker : public Checker<eval::Call> {
26 public:
27  bool evalCall(const CallExpr *CE, CheckerContext &C) const;
28 };
29 
30 }
31 
32 bool BuiltinFunctionChecker::evalCall(const CallExpr *CE,
33  CheckerContext &C) const {
35  const FunctionDecl *FD = C.getCalleeDecl(CE);
36  const LocationContext *LCtx = C.getLocationContext();
37  if (!FD)
38  return false;
39 
40  switch (FD->getBuiltinID()) {
41  default:
42  return false;
43 
44  case Builtin::BI__builtin_assume: {
45  assert (CE->arg_begin() != CE->arg_end());
46  SVal ArgSVal = state->getSVal(CE->getArg(0), LCtx);
47  if (ArgSVal.isUndef())
48  return true; // Return true to model purity.
49 
50  state = state->assume(ArgSVal.castAs<DefinedOrUnknownSVal>(), true);
51  // FIXME: do we want to warn here? Not right now. The most reports might
52  // come from infeasible paths, thus being false positives.
53  if (!state) {
55  return true;
56  }
57 
58  C.addTransition(state);
59  return true;
60  }
61 
62  case Builtin::BI__builtin_unpredictable:
63  case Builtin::BI__builtin_expect:
64  case Builtin::BI__builtin_assume_aligned:
65  case Builtin::BI__builtin_addressof: {
66  // For __builtin_unpredictable, __builtin_expect, and
67  // __builtin_assume_aligned, just return the value of the subexpression.
68  // __builtin_addressof is going from a reference to a pointer, but those
69  // are represented the same way in the analyzer.
70  assert (CE->arg_begin() != CE->arg_end());
71  SVal X = state->getSVal(*(CE->arg_begin()), LCtx);
72  C.addTransition(state->BindExpr(CE, LCtx, X));
73  return true;
74  }
75 
76  case Builtin::BI__builtin_alloca_with_align:
77  case Builtin::BI__builtin_alloca: {
78  // FIXME: Refactor into StoreManager itself?
80  const AllocaRegion* R =
82 
83  // Set the extent of the region in bytes. This enables us to use the
84  // SVal of the argument directly. If we save the extent in bits, we
85  // cannot represent values like symbol*8.
87  state->getSVal(*(CE->arg_begin()), LCtx).castAs<DefinedOrUnknownSVal>();
88 
89  SValBuilder& svalBuilder = C.getSValBuilder();
90  DefinedOrUnknownSVal Extent = R->getExtent(svalBuilder);
91  DefinedOrUnknownSVal extentMatchesSizeArg =
92  svalBuilder.evalEQ(state, Extent, Size);
93  state = state->assume(extentMatchesSizeArg, true);
94  assert(state && "The region should not have any previous constraints");
95 
96  C.addTransition(state->BindExpr(CE, LCtx, loc::MemRegionVal(R)));
97  return true;
98  }
99 
100  case Builtin::BI__builtin_object_size: {
101  // This must be resolvable at compile time, so we defer to the constant
102  // evaluator for a value.
103  SVal V = UnknownVal();
104  llvm::APSInt Result;
105  if (CE->EvaluateAsInt(Result, C.getASTContext(), Expr::SE_NoSideEffects)) {
106  // Make sure the result has the correct type.
107  SValBuilder &SVB = C.getSValBuilder();
109  BVF.getAPSIntType(CE->getType()).apply(Result);
110  V = SVB.makeIntVal(Result);
111  }
112 
113  C.addTransition(state->BindExpr(CE, LCtx, V));
114  return true;
115  }
116  }
117 }
118 
119 void ento::registerBuiltinFunctionChecker(CheckerManager &mgr) {
120  mgr.registerChecker<BuiltinFunctionChecker>();
121 }
FunctionDecl - An instance of this class is created to represent a function declaration or definition...
Definition: Decl.h:1618
nonloc::ConcreteInt makeIntVal(const IntegerLiteral *integer)
Definition: SValBuilder.h:254
Expr * getArg(unsigned Arg)
getArg - Return the specified argument.
Definition: Expr.h:2275
ExplodedNode * addTransition(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generates a new transition in the program state graph (ExplodedGraph).
Strictly evaluate the expression.
Definition: Expr.h:592
AllocaRegion - A region that represents an untyped blob of bytes created by a call to 'alloca'...
Definition: MemRegion.h:454
ExplodedNode * getPredecessor()
Returns the previous node in the exploded graph, which includes the state of the program before the c...
const FunctionDecl * getCalleeDecl(const CallExpr *CE) const
Get the declaration of the called function (path-sensitive).
unsigned blockCount() const
Returns the number of times the current block has been visited along the analyzed path...
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
const AllocaRegion * getAllocaRegion(const Expr *Ex, unsigned Cnt, const LocationContext *LC)
getAllocaRegion - Retrieve a region associated with a call to alloca().
Definition: MemRegion.cpp:1052
arg_iterator arg_end()
Definition: Expr.h:2306
DefinedOrUnknownSVal getExtent(SValBuilder &svalBuilder) const override
getExtent - Returns the size of the region in bytes.
Definition: MemRegion.cpp:172
const ProgramStateRef & getState() const
bool EvaluateAsInt(llvm::APSInt &Result, const ASTContext &Ctx, SideEffectsKind AllowSideEffects=SE_NoSideEffects) const
EvaluateAsInt - Return true if this is a constant which we can fold and convert to an integer...
CHECKER * registerChecker()
Used to register checkers.
StoreManager & getStoreManager()
ExplodedNode * generateSink(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
Generate a sink node.
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
Definition: SVals.h:63
unsigned getBuiltinID() const
Returns a value indicating whether this function corresponds to a builtin function.
Definition: Decl.cpp:2823
QualType getType() const
Definition: Expr.h:127
MemRegionManager & getRegionManager()
getRegionManager - Returns the internal RegionManager object that is used to query and manipulate Mem...
Definition: Store.h:108
BasicValueFactory & getBasicValueFactory()
Definition: SValBuilder.h:144
arg_iterator arg_begin()
Definition: Expr.h:2305
X
Add a minimal nested name specifier fixit hint to allow lookup of a tag name from an outer enclosing ...
Definition: SemaDecl.cpp:13074
SValBuilder & getSValBuilder()
CallExpr - Represents a function call (C99 6.5.2.2, C++ [expr.call]).
Definition: Expr.h:2206
APSIntType getAPSIntType(QualType T) const
Returns the type of the APSInt used to store values of the given QualType.
Defines enum values for all the target-independent builtin functions.
const NamedDecl * Result
Definition: USRFinder.cpp:70
const LocationContext * getLocationContext() const