23 using namespace clang;
27 class ReturnUndefChecker :
public Checker< check::PreStmt<ReturnStmt> > {
28 mutable std::unique_ptr<BuiltinBug> BT_Undef;
29 mutable std::unique_ptr<BuiltinBug> BT_NullReference;
39 void ReturnUndefChecker::checkPreStmt(
const ReturnStmt *RS,
82 const Expr *TrackingE =
nullptr) {
87 auto Report = llvm::make_unique<BugReport>(BT, BT.
getDescription(), N);
90 bugreporter::trackNullOrUndefValue(N, TrackingE ? TrackingE : RetE, *Report);
99 "Undefined or garbage value returned to caller"));
106 std::tie(StNonNull, StNull) = C.
getState()->assume(RetVal);
115 if (!BT_NullReference)
116 BT_NullReference.reset(
new BuiltinBug(
this,
"Returning null reference"));
118 emitBug(C, *BT_NullReference, RetE, bugreporter::getDerefExpr(RetE));
A (possibly-)qualified type.
ExplodedNode * generateErrorNode(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generate a transition to a node that will be used to report an error.
ExplodedNode * addTransition(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generates a new transition in the program state graph (ExplodedGraph).
SVal getSVal(const Stmt *S) const
Get the value of arbitrary expressions at this point in the path.
StringRef getDescription() const
static void emitBug(CheckerContext &C, BuiltinBug &BT, const Expr *RetE, const Expr *TrackingE=nullptr)
const Expr * getRetValue() const
bool isReferenceType() const
Expr - This represents one expression.
ReturnStmt - This represents a return, optionally of an expression: return; return 4;...
bool isNull() const
Return true if this QualType doesn't point to a type yet.
CHECKER * registerChecker(AT... Args)
Used to register checkers.
void emitReport(std::unique_ptr< BugReport > R)
Emit the diagnostics report.
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
Dataflow Directional Tag Classes.
const Decl * getDecl() const
const StackFrameContext * getStackFrame() const
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
const ProgramStateRef & getState() const
static QualType getDeclaredResultType(const Decl *D)
Returns the result type of a function or method declaration.
SourceRange getSourceRange() const LLVM_READONLY
SourceLocation tokens are not useful in isolation - they are low level value objects created/interpre...