Coverage Report

Created: 2018-11-16 02:38

/Users/buildslave/jenkins/workspace/clang-stage2-coverage-R/llvm/tools/clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h
Line
Count
Source
1
//== CheckerContext.h - Context info for path-sensitive checkers--*- C++ -*--=//
2
//
3
//                     The LLVM Compiler Infrastructure
4
//
5
// This file is distributed under the University of Illinois Open Source
6
// License. See LICENSE.TXT for details.
7
//
8
//===----------------------------------------------------------------------===//
9
//
10
//  This file defines CheckerContext that provides contextual info for
11
// path-sensitive checkers.
12
//
13
//===----------------------------------------------------------------------===//
14
15
#ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CHECKERCONTEXT_H
16
#define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CHECKERCONTEXT_H
17
18
#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
19
#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
20
21
namespace clang {
22
namespace ento {
23
24
class CheckerContext {
25
  ExprEngine &Eng;
26
  /// The current exploded(symbolic execution) graph node.
27
  ExplodedNode *Pred;
28
  /// The flag is true if the (state of the execution) has been modified
29
  /// by the checker using this context. For example, a new transition has been
30
  /// added or a bug report issued.
31
  bool Changed;
32
  /// The tagged location, which is used to generate all new nodes.
33
  const ProgramPoint Location;
34
  NodeBuilder &NB;
35
36
public:
37
  /// If we are post visiting a call, this flag will be set if the
38
  /// call was inlined.  In all other cases it will be false.
39
  const bool wasInlined;
40
41
  CheckerContext(NodeBuilder &builder,
42
                 ExprEngine &eng,
43
                 ExplodedNode *pred,
44
                 const ProgramPoint &loc,
45
                 bool wasInlined = false)
46
    : Eng(eng),
47
      Pred(pred),
48
      Changed(false),
49
      Location(loc),
50
      NB(builder),
51
2.18M
      wasInlined(wasInlined) {
52
2.18M
    assert(Pred->getState() &&
53
2.18M
           "We should not call the checkers on an empty state.");
54
2.18M
  }
55
56
56.9k
  AnalysisManager &getAnalysisManager() {
57
56.9k
    return Eng.getAnalysisManager();
58
56.9k
  }
59
60
13.3k
  ConstraintManager &getConstraintManager() {
61
13.3k
    return Eng.getConstraintManager();
62
13.3k
  }
63
64
584
  StoreManager &getStoreManager() {
65
584
    return Eng.getStoreManager();
66
584
  }
67
68
  /// Returns the previous node in the exploded graph, which includes
69
  /// the state of the program before the checker ran. Note, checkers should
70
  /// not retain the node in their state since the nodes might get invalidated.
71
45.0k
  ExplodedNode *getPredecessor() { return Pred; }
72
852k
  const ProgramStateRef &getState() const { return Pred->getState(); }
73
74
  /// Check if the checker changed the state of the execution; ex: added
75
  /// a new transition or a bug report.
76
1.84k
  bool isDifferent() { return Changed; }
77
78
  /// Returns the number of times the current block has been visited
79
  /// along the analyzed path.
80
3.10k
  unsigned blockCount() const {
81
3.10k
    return NB.getContext().blockCount();
82
3.10k
  }
83
84
277k
  ASTContext &getASTContext() {
85
277k
    return Eng.getContext();
86
277k
  }
87
88
222
  const LangOptions &getLangOpts() const {
89
222
    return Eng.getContext().getLangOpts();
90
222
  }
91
92
112k
  const LocationContext *getLocationContext() const {
93
112k
    return Pred->getLocationContext();
94
112k
  }
95
96
53.6k
  const StackFrameContext *getStackFrame() const {
97
53.6k
    return Pred->getStackFrame();
98
53.6k
  }
99
100
  /// Return true if the current LocationContext has no caller context.
101
8.03k
  bool inTopFrame() const { return getLocationContext()->inTopFrame();  }
102
103
9.76k
  BugReporter &getBugReporter() {
104
9.76k
    return Eng.getBugReporter();
105
9.76k
  }
106
107
1.12k
  SourceManager &getSourceManager() {
108
1.12k
    return getBugReporter().getSourceManager();
109
1.12k
  }
110
111
26.3k
  SValBuilder &getSValBuilder() {
112
26.3k
    return Eng.getSValBuilder();
113
26.3k
  }
114
115
938
  SymbolManager &getSymbolManager() {
116
938
    return getSValBuilder().getSymbolManager();
117
938
  }
118
119
301
  ProgramStateManager &getStateManager() {
120
301
    return Eng.getStateManager();
121
301
  }
122
123
2.32k
  AnalysisDeclContext *getCurrentAnalysisDeclContext() const {
124
2.32k
    return Pred->getLocationContext()->getAnalysisDeclContext();
125
2.32k
  }
126
127
  /// Get the blockID.
128
444
  unsigned getBlockID() const {
129
444
    return NB.getContext().getBlock()->getBlockID();
130
444
  }
131
132
  /// If the given node corresponds to a PostStore program point,
133
  /// retrieve the location region as it was uttered in the code.
134
  ///
135
  /// This utility can be useful for generating extensive diagnostics, for
136
  /// example, for finding variables that the given symbol was assigned to.
137
6.29k
  static const MemRegion *getLocationRegionIfPostStore(const ExplodedNode *N) {
138
6.29k
    ProgramPoint L = N->getLocation();
139
6.29k
    if (Optional<PostStore> PSL = L.getAs<PostStore>())
140
327
      return reinterpret_cast<const MemRegion*>(PSL->getLocationValue());
141
5.97k
    return nullptr;
142
5.97k
  }
143
144
  /// Get the value of arbitrary expressions at this point in the path.
145
194k
  SVal getSVal(const Stmt *S) const {
146
194k
    return Pred->getSVal(S);
147
194k
  }
148
149
  /// Returns true if the value of \p E is greater than or equal to \p
150
  /// Val under unsigned comparison
151
  bool isGreaterOrEqual(const Expr *E, unsigned long long Val);
152
153
  /// Returns true if the value of \p E is negative.
154
  bool isNegative(const Expr *E);
155
156
  /// Generates a new transition in the program state graph
157
  /// (ExplodedGraph). Uses the default CheckerContext predecessor node.
158
  ///
159
  /// @param State The state of the generated node. If not specified, the state
160
  ///        will not be changed, but the new node will have the checker's tag.
161
  /// @param Tag The tag is used to uniquely identify the creation site. If no
162
  ///        tag is specified, a default tag, unique to the given checker,
163
  ///        will be used. Tags are used to prevent states generated at
164
  ///        different sites from caching out.
165
  ExplodedNode *addTransition(ProgramStateRef State = nullptr,
166
419k
                              const ProgramPointTag *Tag = nullptr) {
167
419k
    return addTransitionImpl(State ? 
State412k
:
getState()6.36k
, false, nullptr, Tag);
168
419k
  }
169
170
  /// Generates a new transition with the given predecessor.
171
  /// Allows checkers to generate a chain of nodes.
172
  ///
173
  /// @param State The state of the generated node.
174
  /// @param Pred The transition will be generated from the specified Pred node
175
  ///             to the newly generated node.
176
  /// @param Tag The tag to uniquely identify the creation site.
177
  ExplodedNode *addTransition(ProgramStateRef State,
178
                              ExplodedNode *Pred,
179
27.1k
                              const ProgramPointTag *Tag = nullptr) {
180
27.1k
    return addTransitionImpl(State, false, Pred, Tag);
181
27.1k
  }
182
183
  /// Generate a sink node. Generating a sink stops exploration of the
184
  /// given path. To create a sink node for the purpose of reporting an error,
185
  /// checkers should use generateErrorNode() instead.
186
  ExplodedNode *generateSink(ProgramStateRef State, ExplodedNode *Pred,
187
6.01k
                             const ProgramPointTag *Tag = nullptr) {
188
6.01k
    return addTransitionImpl(State ? 
State5.05k
:
getState()961
, true, Pred, Tag);
189
6.01k
  }
190
191
  /// Generate a transition to a node that will be used to report
192
  /// an error. This node will be a sink. That is, it will stop exploration of
193
  /// the given path.
194
  ///
195
  /// @param State The state of the generated node.
196
  /// @param Tag The tag to uniquely identify the creation site. If null,
197
  ///        the default tag for the checker will be used.
198
  ExplodedNode *generateErrorNode(ProgramStateRef State = nullptr,
199
2.40k
                                  const ProgramPointTag *Tag = nullptr) {
200
2.40k
    return generateSink(State, Pred,
201
2.40k
                       (Tag ? 
Tag34
:
Location.getTag()2.36k
));
202
2.40k
  }
203
204
  /// Generate a transition to a node that will be used to report
205
  /// an error. This node will not be a sink. That is, exploration will
206
  /// continue along this path.
207
  ///
208
  /// @param State The state of the generated node.
209
  /// @param Tag The tag to uniquely identify the creation site. If null,
210
  ///        the default tag for the checker will be used.
211
  ExplodedNode *
212
  generateNonFatalErrorNode(ProgramStateRef State = nullptr,
213
6.92k
                            const ProgramPointTag *Tag = nullptr) {
214
6.92k
    return addTransition(State, (Tag ? 
Tag372
:
Location.getTag()6.54k
));
215
6.92k
  }
216
217
  /// Emit the diagnostics report.
218
3.94k
  void emitReport(std::unique_ptr<BugReport> R) {
219
3.94k
    Changed = true;
220
3.94k
    Eng.getBugReporter().emitReport(std::move(R));
221
3.94k
  }
222
223
  /// Returns the word that should be used to refer to the declaration
224
  /// in the report.
225
  StringRef getDeclDescription(const Decl *D);
226
227
  /// Get the declaration of the called function (path-sensitive).
228
  const FunctionDecl *getCalleeDecl(const CallExpr *CE) const;
229
230
  /// Get the name of the called function (path-sensitive).
231
  StringRef getCalleeName(const FunctionDecl *FunDecl) const;
232
233
  /// Get the identifier of the called function (path-sensitive).
234
  const IdentifierInfo *getCalleeIdentifier(const CallExpr *CE) const {
235
    const FunctionDecl *FunDecl = getCalleeDecl(CE);
236
    if (FunDecl)
237
      return FunDecl->getIdentifier();
238
    else
239
      return nullptr;
240
  }
241
242
  /// Get the name of the called function (path-sensitive).
243
13.4k
  StringRef getCalleeName(const CallExpr *CE) const {
244
13.4k
    const FunctionDecl *FunDecl = getCalleeDecl(CE);
245
13.4k
    return getCalleeName(FunDecl);
246
13.4k
  }
247
248
  /// Returns true if the callee is an externally-visible function in the
249
  /// top-level namespace, such as \c malloc.
250
  ///
251
  /// If a name is provided, the function must additionally match the given
252
  /// name.
253
  ///
254
  /// Note that this deliberately excludes C++ library functions in the \c std
255
  /// namespace, but will include C library functions accessed through the
256
  /// \c std namespace. This also does not check if the function is declared
257
  /// as 'extern "C"', or if it uses C++ name mangling.
258
  static bool isCLibraryFunction(const FunctionDecl *FD,
259
                                 StringRef Name = StringRef());
260
261
  /// Depending on wither the location corresponds to a macro, return
262
  /// either the macro name or the token spelling.
263
  ///
264
  /// This could be useful when checkers' logic depends on whether a function
265
  /// is called with a given macro argument. For example:
266
  ///   s = socket(AF_INET,..)
267
  /// If AF_INET is a macro, the result should be treated as a source of taint.
268
  ///
269
  /// \sa clang::Lexer::getSpelling(), clang::Lexer::getImmediateMacroName().
270
  StringRef getMacroNameOrSpelling(SourceLocation &Loc);
271
272
private:
273
  ExplodedNode *addTransitionImpl(ProgramStateRef State,
274
                                 bool MarkAsSink,
275
                                 ExplodedNode *P = nullptr,
276
452k
                                 const ProgramPointTag *Tag = nullptr) {
277
452k
    // The analyzer may stop exploring if it sees a state it has previously
278
452k
    // visited ("cache out"). The early return here is a defensive check to
279
452k
    // prevent accidental caching out by checker API clients. Unless there is a
280
452k
    // tag or the client checker has requested that the generated node be
281
452k
    // marked as a sink, we assume that a client requesting a transition to a
282
452k
    // state that is the same as the predecessor state has made a mistake. We
283
452k
    // return the predecessor rather than cache out.
284
452k
    //
285
452k
    // TODO: We could potentially change the return to an assertion to alert
286
452k
    // clients to their mistake, but several checkers (including
287
452k
    // DereferenceChecker, CallAndMessageChecker, and DynamicTypePropagation)
288
452k
    // rely upon the defensive behavior and would need to be updated.
289
452k
    if (!State || (State == Pred->getState() && 
!Tag412k
&&
!MarkAsSink402k
))
290
402k
      return Pred;
291
50.3k
292
50.3k
    Changed = true;
293
50.3k
    const ProgramPoint &LocalLoc = (Tag ? 
Location.withTag(Tag)10.0k
:
Location40.3k
);
294
50.3k
    if (!P)
295
34.7k
      P = Pred;
296
50.3k
297
50.3k
    ExplodedNode *node;
298
50.3k
    if (MarkAsSink)
299
6.01k
      node = NB.generateSink(LocalLoc, State, P);
300
44.3k
    else
301
44.3k
      node = NB.generateNode(LocalLoc, State, P);
302
50.3k
    return node;
303
50.3k
  }
304
};
305
306
} // end GR namespace
307
308
} // end clang namespace
309
310
#endif