22 using namespace clang;
27 class UndefBranchChecker :
public Checker<check::BranchCondition> {
28 mutable std::unique_ptr<BuiltinBug> BT;
30 struct FindUndefExpr {
35 : St(
std::move(S)), LCtx(L) {}
37 const Expr *FindExpr(
const Expr *Ex) {
38 if (!MatchesCriteria(Ex))
42 if (
const Expr *ExI = dyn_cast_or_null<Expr>(SubStmt))
43 if (
const Expr *E2 = FindExpr(ExI))
49 bool MatchesCriteria(
const Expr *Ex) {
50 return St->getSVal(Ex, LCtx).isUndef();
60 void UndefBranchChecker::checkBranchCondition(
const Stmt *Condition,
70 this,
"Branch condition evaluates to a garbage value"));
87 const Expr *Ex = cast<Expr>(Condition);
93 if (PS->getStmt() == Ex)
94 St = PrevN->getState();
97 Ex = FindIt.FindExpr(Ex);
100 auto R = llvm::make_unique<BugReport>(*BT, BT->getDescription(), N);
101 bugreporter::trackNullOrUndefValue(N, Ex, *R);
102 R->addRange(Ex->getSourceRange());
ExplodedNode * generateErrorNode(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generate a transition to a node that will be used to report an error.
Stmt - This represents one statement.
const ProgramStateRef & getState() const
SVal getSVal(const Stmt *S) const
Get the value of arbitrary expressions at this point in the path.
Expr - This represents one expression.
CHECKER * registerChecker(AT... Args)
Used to register checkers.
void emitReport(std::unique_ptr< BugReport > R)
Emit the diagnostics report.
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
Dataflow Directional Tag Classes.
X
Add a minimal nested name specifier fixit hint to allow lookup of a tag name from an outer enclosing ...
pred_iterator pred_begin()
Optional< T > getAs() const
Convert to the specified ProgramPoint type, returning None if this ProgramPoint is not of the desired...
const LocationContext * getLocationContext() const