clang
9.0.0
|
#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
Public Member Functions | |
CheckerContext (NodeBuilder &builder, ExprEngine &eng, ExplodedNode *pred, const ProgramPoint &loc, bool wasInlined=false) | |
AnalysisManager & | getAnalysisManager () |
ConstraintManager & | getConstraintManager () |
StoreManager & | getStoreManager () |
ExplodedNode * | getPredecessor () |
Returns the previous node in the exploded graph, which includes the state of the program before the checker ran. More... | |
const ProgramStateRef & | getState () const |
bool | isDifferent () |
Check if the checker changed the state of the execution; ex: added a new transition or a bug report. More... | |
unsigned | blockCount () const |
Returns the number of times the current block has been visited along the analyzed path. More... | |
ASTContext & | getASTContext () |
const LangOptions & | getLangOpts () const |
const LocationContext * | getLocationContext () const |
const StackFrameContext * | getStackFrame () const |
bool | inTopFrame () const |
Return true if the current LocationContext has no caller context. More... | |
BugReporter & | getBugReporter () |
SourceManager & | getSourceManager () |
SValBuilder & | getSValBuilder () |
SymbolManager & | getSymbolManager () |
ProgramStateManager & | getStateManager () |
AnalysisDeclContext * | getCurrentAnalysisDeclContext () const |
unsigned | getBlockID () const |
Get the blockID. More... | |
SVal | getSVal (const Stmt *S) const |
Get the value of arbitrary expressions at this point in the path. More... | |
bool | isGreaterOrEqual (const Expr *E, unsigned long long Val) |
Returns true if the value of E is greater than or equal to Val under unsigned comparison. More... | |
bool | isNegative (const Expr *E) |
Returns true if the value of E is negative. More... | |
ExplodedNode * | addTransition (ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr) |
Generates a new transition in the program state graph (ExplodedGraph). More... | |
ExplodedNode * | addTransition (ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr) |
Generates a new transition with the given predecessor. More... | |
ExplodedNode * | generateSink (ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr) |
Generate a sink node. More... | |
ExplodedNode * | generateErrorNode (ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr) |
Generate a transition to a node that will be used to report an error. More... | |
ExplodedNode * | generateNonFatalErrorNode (ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr) |
Generate a transition to a node that will be used to report an error. More... | |
void | emitReport (std::unique_ptr< BugReport > R) |
Emit the diagnostics report. More... | |
const NoteTag * | getNoteTag (NoteTag::Callback &&Cb, bool IsPrunable=false) |
Produce a program point tag that displays an additional path note to the user. More... | |
const NoteTag * | getNoteTag (std::function< std::string(BugReport &)> &&Cb, bool IsPrunable=false) |
A shorthand version of getNoteTag that doesn't require you to accept the BugReporterContext arguments when you don't need it. More... | |
const NoteTag * | getNoteTag (StringRef Note, bool IsPrunable=false) |
A shorthand version of getNoteTag that accepts a plain note. More... | |
StringRef | getDeclDescription (const Decl *D) |
Returns the word that should be used to refer to the declaration in the report. More... | |
const FunctionDecl * | getCalleeDecl (const CallExpr *CE) const |
Get the declaration of the called function (path-sensitive). More... | |
StringRef | getCalleeName (const FunctionDecl *FunDecl) const |
Get the name of the called function (path-sensitive). More... | |
const IdentifierInfo * | getCalleeIdentifier (const CallExpr *CE) const |
Get the identifier of the called function (path-sensitive). More... | |
StringRef | getCalleeName (const CallExpr *CE) const |
Get the name of the called function (path-sensitive). More... | |
StringRef | getMacroNameOrSpelling (SourceLocation &Loc) |
Depending on wither the location corresponds to a macro, return either the macro name or the token spelling. More... | |
Static Public Member Functions | |
static const MemRegion * | getLocationRegionIfPostStore (const ExplodedNode *N) |
If the given node corresponds to a PostStore program point, retrieve the location region as it was uttered in the code. More... | |
static bool | isCLibraryFunction (const FunctionDecl *FD, StringRef Name=StringRef()) |
Returns true if the callee is an externally-visible function in the top-level namespace, such as malloc . More... | |
Public Attributes | |
const bool | wasInlined |
If we are post visiting a call, this flag will be set if the call was inlined. More... | |
Definition at line 23 of file CheckerContext.h.
|
inline |
Definition at line 40 of file CheckerContext.h.
References clang::ento::ExplodedNode::getState().
|
inline |
Generates a new transition in the program state graph (ExplodedGraph).
Uses the default CheckerContext predecessor node.
State | The state of the generated node. If not specified, the state will not be changed, but the new node will have the checker's tag. |
Tag | The tag is used to uniquely identify the creation site. If no tag is specified, a default tag, unique to the given checker, will be used. Tags are used to prevent states generated at different sites from caching out. |
Definition at line 164 of file CheckerContext.h.
References getState(), and State.
Referenced by clang::ento::retaincountchecker::RetainCountChecker::checkBeginFunction(), clang::ento::retaincountchecker::RetainCountChecker::checkBind(), clang::ento::retaincountchecker::RetainCountChecker::checkDeadSymbols(), clang::ento::mpi::MPIChecker::checkDoubleNonblocking(), clang::ento::mpi::MPIChecker::checkMissingWaits(), clang::ento::retaincountchecker::RetainCountChecker::checkPostStmt(), clang::ento::retaincountchecker::RetainCountChecker::checkReturnWithRetEffect(), clang::ento::retaincountchecker::RetainCountChecker::checkSummary(), clang::ento::mpi::MPIChecker::checkUnmatchedWaits(), clang::ento::retaincountchecker::RetainCountChecker::evalCall(), generateNonFatalErrorNode(), clang::ento::retaincountchecker::RetainCountChecker::processLeaks(), clang::ento::retaincountchecker::RetainCountChecker::processObjCLiterals(), and clang::ento::retaincountchecker::RetainCountChecker::processSummaryOfInlined().
|
inline |
Generates a new transition with the given predecessor.
Allows checkers to generate a chain of nodes.
State | The state of the generated node. |
Pred | The transition will be generated from the specified Pred node to the newly generated node. |
Tag | The tag to uniquely identify the creation site. |
Definition at line 176 of file CheckerContext.h.
|
inline |
Returns the number of times the current block has been visited along the analyzed path.
Definition at line 79 of file CheckerContext.h.
References clang::ento::NodeBuilderContext::blockCount(), and clang::ento::NodeBuilder::getContext().
Referenced by clang::ento::retaincountchecker::RetainCountChecker::evalCall().
|
inline |
Emit the diagnostics report.
Definition at line 217 of file CheckerContext.h.
References clang::ento::BugReporter::emitReport(), and clang::ento::ExprEngine::getBugReporter().
Referenced by clang::ento::retaincountchecker::RetainCountChecker::checkReturnWithRetEffect(), clang::ento::retaincountchecker::RetainCountChecker::handleAutoreleaseCounts(), clang::ento::retaincountchecker::RetainCountChecker::processLeaks(), and clang::ento::retaincountchecker::RetainCountChecker::processNonLeakError().
|
inline |
Generate a transition to a node that will be used to report an error.
This node will be a sink. That is, it will stop exploration of the given path.
State | The state of the generated node. |
Tag | The tag to uniquely identify the creation site. If null, the default tag for the checker will be used. |
Definition at line 197 of file CheckerContext.h.
References generateSink(), clang::ProgramPoint::getTag(), and State.
Referenced by clang::ento::retaincountchecker::RetainCountChecker::processNonLeakError().
|
inline |
Generate a transition to a node that will be used to report an error.
This node will not be a sink. That is, exploration will continue along this path.
State | The state of the generated node. |
Tag | The tag to uniquely identify the creation site. If null, the default tag for the checker will be used. |
Definition at line 211 of file CheckerContext.h.
References addTransition(), clang::ProgramPoint::getTag(), and State.
Referenced by clang::ento::mpi::MPIChecker::checkDoubleNonblocking(), clang::ento::mpi::MPIChecker::checkMissingWaits(), and clang::ento::mpi::MPIChecker::checkUnmatchedWaits().
|
inline |
Generate a sink node.
Generating a sink stops exploration of the given path. To create a sink node for the purpose of reporting an error, checkers should use generateErrorNode() instead.
Definition at line 185 of file CheckerContext.h.
References getState().
Referenced by generateErrorNode(), and clang::ento::retaincountchecker::RetainCountChecker::handleAutoreleaseCounts().
|
inline |
Definition at line 55 of file CheckerContext.h.
References clang::ento::ExprEngine::getAnalysisManager().
|
inline |
Definition at line 83 of file CheckerContext.h.
References clang::ento::ExprEngine::getContext().
Referenced by clang::ento::mpi::MPIChecker::checkMissingWaits(), clang::ento::retaincountchecker::RetainCountChecker::checkReturnWithRetEffect(), clang::ento::retaincountchecker::RetainCountChecker::checkSummary(), clang::ento::mpi::MPIChecker::dynamicInit(), clang::ento::retaincountchecker::RetainCountChecker::getSummaryManager(), clang::ento::retaincountchecker::RetainCountChecker::handleAutoreleaseCounts(), isGreaterOrEqual(), clang::ento::retaincountchecker::RetainCountChecker::processLeaks(), clang::ento::retaincountchecker::RetainCountChecker::processNonLeakError(), and clang::ento::retaincountchecker::RetainCountChecker::updateSymbol().
|
inline |
Get the blockID.
Definition at line 127 of file CheckerContext.h.
References clang::ento::NodeBuilderContext::getBlock(), clang::CFGBlock::getBlockID(), and clang::ento::NodeBuilder::getContext().
|
inline |
Definition at line 102 of file CheckerContext.h.
References clang::ento::ExprEngine::getBugReporter().
Referenced by clang::ento::mpi::MPIChecker::checkDoubleNonblocking(), clang::ento::mpi::MPIChecker::checkMissingWaits(), clang::ento::mpi::MPIChecker::checkUnmatchedWaits(), and getSourceManager().
const FunctionDecl * CheckerContext::getCalleeDecl | ( | const CallExpr * | CE | ) | const |
Get the declaration of the called function (path-sensitive).
Definition at line 21 of file CheckerContext.cpp.
References clang::ento::SVal::getAsFunctionDecl(), clang::CallExpr::getCallee(), and clang::ento::ExplodedNode::getSVal().
Referenced by getCalleeIdentifier(), getCalleeName(), and getNoteTag().
|
inline |
Get the identifier of the called function (path-sensitive).
Definition at line 272 of file CheckerContext.h.
References getCalleeDecl(), and clang::NamedDecl::getIdentifier().
StringRef CheckerContext::getCalleeName | ( | const FunctionDecl * | FunDecl | ) | const |
Get the name of the called function (path-sensitive).
Definition at line 27 of file CheckerContext.cpp.
References clang::NamedDecl::getIdentifier(), and clang::IdentifierInfo::getName().
Referenced by getCalleeName(), and getNoteTag().
|
inline |
Get the name of the called function (path-sensitive).
Definition at line 281 of file CheckerContext.h.
References getCalleeDecl(), getCalleeName(), and isCLibraryFunction().
|
inline |
Definition at line 59 of file CheckerContext.h.
References clang::ento::ExprEngine::getConstraintManager().
|
inline |
Definition at line 122 of file CheckerContext.h.
References clang::LocationContext::getAnalysisDeclContext(), and clang::ento::ExplodedNode::getLocationContext().
StringRef CheckerContext::getDeclDescription | ( | const Decl * | D | ) |
Returns the word that should be used to refer to the declaration in the report.
Definition at line 36 of file CheckerContext.cpp.
Referenced by getNoteTag().
|
inline |
Definition at line 87 of file CheckerContext.h.
References clang::ento::ExprEngine::getContext(), and clang::ASTContext::getLangOpts().
Referenced by getMacroNameOrSpelling().
|
inline |
Definition at line 91 of file CheckerContext.h.
References clang::ento::ExplodedNode::getLocationContext().
Referenced by clang::ento::retaincountchecker::RetainCountChecker::checkBeginFunction(), clang::ento::retaincountchecker::RetainCountChecker::checkPostStmt(), clang::ento::retaincountchecker::RetainCountChecker::evalCall(), inTopFrame(), and willObjectBeAnalyzedLater().
|
inlinestatic |
If the given node corresponds to a PostStore program point, retrieve the location region as it was uttered in the code.
This utility can be useful for generating extensive diagnostics, for example, for finding variables that the given symbol was assigned to.
Definition at line 136 of file CheckerContext.h.
References clang::ProgramPoint::getAs(), and clang::ento::ExplodedNode::getLocation().
StringRef CheckerContext::getMacroNameOrSpelling | ( | SourceLocation & | Loc | ) |
Depending on wither the location corresponds to a macro, return either the macro name or the token spelling.
This could be useful when checkers' logic depends on whether a function is called with a given macro argument. For example: s = socket(AF_INET,..) If AF_INET is a macro, the result should be treated as a source of taint.
Definition at line 92 of file CheckerContext.cpp.
References clang::Lexer::getImmediateMacroName(), getLangOpts(), getSourceManager(), clang::Lexer::getSpelling(), and clang::SourceLocation::isMacroID().
|
inline |
Produce a program point tag that displays an additional path note to the user.
This is a lightweight alternative to the BugReporterVisitor mechanism: instead of visiting the bug report node-by-node to restore the sequence of events that led to discovering a bug, you can add notes as you add your transitions.
Cb | Callback with 'BugReporterContext &, BugReport &' parameters. |
IsPrunable | Whether the note is prunable. It allows BugReporter to omit the note from the report if it would make the displayed bug path significantly shorter. |
Definition at line 232 of file CheckerContext.h.
References clang::ento::ExprEngine::getNoteTags(), and clang::ento::NoteTag::Factory::makeNoteTag().
Referenced by getNoteTag().
|
inline |
A shorthand version of getNoteTag that doesn't require you to accept the BugReporterContext arguments when you don't need it.
Cb | Callback only with 'BugReport &' parameter. |
IsPrunable | Whether the note is prunable. It allows BugReporter to omit the note from the report if it would make the displayed bug path significantly shorter. |
Definition at line 243 of file CheckerContext.h.
References getNoteTag().
|
inline |
A shorthand version of getNoteTag that accepts a plain note.
Note | The note. |
IsPrunable | Whether the note is prunable. It allows BugReporter to omit the note from the report if it would make the displayed bug path significantly shorter. |
Definition at line 256 of file CheckerContext.h.
References getCalleeDecl(), getCalleeName(), getDeclDescription(), and getNoteTag().
|
inline |
Returns the previous node in the exploded graph, which includes the state of the program before the checker ran.
Note, checkers should not retain the node in their state since the nodes might get invalidated.
Definition at line 70 of file CheckerContext.h.
Referenced by clang::ento::retaincountchecker::RetainCountChecker::checkDeadSymbols(), clang::ento::retaincountchecker::RetainCountChecker::checkPostStmt(), clang::ento::retaincountchecker::RetainCountChecker::checkSummary(), and clang::ento::retaincountchecker::RetainCountChecker::processObjCLiterals().
|
inline |
Definition at line 106 of file CheckerContext.h.
References getBugReporter(), and clang::ento::BugReporter::getSourceManager().
Referenced by getMacroNameOrSpelling().
|
inline |
Definition at line 95 of file CheckerContext.h.
References clang::ento::ExplodedNode::getStackFrame().
Referenced by clang::ento::retaincountchecker::RetainCountChecker::checkPostStmt(), and getConstructedRegion().
|
inline |
Definition at line 71 of file CheckerContext.h.
References clang::ento::ExplodedNode::getState().
Referenced by addTransition(), clang::ento::retaincountchecker::RetainCountChecker::checkBeginFunction(), clang::ento::retaincountchecker::RetainCountChecker::checkBind(), clang::ento::retaincountchecker::RetainCountChecker::checkDeadSymbols(), clang::ento::mpi::MPIChecker::checkDoubleNonblocking(), clang::ento::mpi::MPIChecker::checkMissingWaits(), clang::ento::retaincountchecker::RetainCountChecker::checkPostCall(), clang::ento::retaincountchecker::RetainCountChecker::checkPostStmt(), clang::ento::retaincountchecker::RetainCountChecker::checkSummary(), clang::ento::mpi::MPIChecker::checkUnmatchedWaits(), clang::ento::retaincountchecker::RetainCountChecker::evalCall(), generateSink(), getConstructedRegion(), isGreaterOrEqual(), isNegative(), clang::ento::retaincountchecker::RetainCountChecker::processObjCLiterals(), and clang::ento::retaincountchecker::RetainCountChecker::processSummaryOfInlined().
|
inline |
Definition at line 118 of file CheckerContext.h.
References clang::ento::ExprEngine::getStateManager().
|
inline |
Definition at line 63 of file CheckerContext.h.
References clang::ento::ExprEngine::getStoreManager().
Referenced by clang::ento::mpi::MPIChecker::checkMissingWaits().
Get the value of arbitrary expressions at this point in the path.
Definition at line 144 of file CheckerContext.h.
Referenced by clang::ento::retaincountchecker::RetainCountChecker::checkPostStmt(), isGreaterOrEqual(), and isNegative().
|
inline |
Definition at line 110 of file CheckerContext.h.
References clang::ento::ExprEngine::getSValBuilder().
Referenced by clang::ento::mpi::MPIChecker::checkMissingWaits(), clang::ento::retaincountchecker::RetainCountChecker::checkPostStmt(), clang::ento::retaincountchecker::RetainCountChecker::evalCall(), getConstructedRegion(), getSymbolManager(), isGreaterOrEqual(), and isNegative().
|
inline |
Definition at line 114 of file CheckerContext.h.
References getSValBuilder(), and clang::ento::SValBuilder::getSymbolManager().
|
inline |
Return true if the current LocationContext has no caller context.
Definition at line 100 of file CheckerContext.h.
References getLocationContext(), and clang::LocationContext::inTopFrame().
Referenced by clang::ento::retaincountchecker::RetainCountChecker::checkBeginFunction().
|
static |
Returns true if the callee is an externally-visible function in the top-level namespace, such as malloc
.
If a name is provided, the function must additionally match the given name.
Note that this deliberately excludes C++ library functions in the std
namespace, but will include C library functions accessed through the std
namespace. This also does not check if the function is declared as 'extern "C"', or if it uses C++ name mangling.
Definition at line 44 of file CheckerContext.cpp.
Referenced by getCalleeName(), clang::ento::CallEvent::isCalled(), and clang::ento::CallEvent::isGlobalCFunction().
|
inline |
Check if the checker changed the state of the execution; ex: added a new transition or a bug report.
Definition at line 75 of file CheckerContext.h.
Returns true if the value of E
is greater than or equal to Val
under unsigned comparison.
Definition at line 123 of file CheckerContext.cpp.
References evalComparison(), getASTContext(), getState(), getSVal(), getSValBuilder(), clang::ento::SValBuilder::makeIntVal(), and V.
Returns true if the value of E
is negative.
Definition at line 128 of file CheckerContext.cpp.
References evalComparison(), getState(), getSVal(), getSValBuilder(), clang::ento::SValBuilder::makeIntVal(), and V.
const bool clang::ento::CheckerContext::wasInlined |
If we are post visiting a call, this flag will be set if the call was inlined.
In all other cases it will be false.
Definition at line 38 of file CheckerContext.h.
Referenced by clang::ento::retaincountchecker::RetainCountChecker::checkPostCall().