Coverage Report

Created: 2019-02-20 07:29

/Users/buildslave/jenkins/workspace/clang-stage2-coverage-R/llvm/tools/clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h
Line
Count
Source
1
//== CheckerContext.h - Context info for path-sensitive checkers--*- C++ -*--=//
2
//
3
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4
// See https://llvm.org/LICENSE.txt for license information.
5
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6
//
7
//===----------------------------------------------------------------------===//
8
//
9
//  This file defines CheckerContext that provides contextual info for
10
// path-sensitive checkers.
11
//
12
//===----------------------------------------------------------------------===//
13
14
#ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CHECKERCONTEXT_H
15
#define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CHECKERCONTEXT_H
16
17
#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
18
#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
19
20
namespace clang {
21
namespace ento {
22
23
class CheckerContext {
24
  ExprEngine &Eng;
25
  /// The current exploded(symbolic execution) graph node.
26
  ExplodedNode *Pred;
27
  /// The flag is true if the (state of the execution) has been modified
28
  /// by the checker using this context. For example, a new transition has been
29
  /// added or a bug report issued.
30
  bool Changed;
31
  /// The tagged location, which is used to generate all new nodes.
32
  const ProgramPoint Location;
33
  NodeBuilder &NB;
34
35
public:
36
  /// If we are post visiting a call, this flag will be set if the
37
  /// call was inlined.  In all other cases it will be false.
38
  const bool wasInlined;
39
40
  CheckerContext(NodeBuilder &builder,
41
                 ExprEngine &eng,
42
                 ExplodedNode *pred,
43
                 const ProgramPoint &loc,
44
                 bool wasInlined = false)
45
    : Eng(eng),
46
      Pred(pred),
47
      Changed(false),
48
      Location(loc),
49
      NB(builder),
50
3.03M
      wasInlined(wasInlined) {
51
3.03M
    assert(Pred->getState() &&
52
3.03M
           "We should not call the checkers on an empty state.");
53
3.03M
  }
54
55
58.4k
  AnalysisManager &getAnalysisManager() {
56
58.4k
    return Eng.getAnalysisManager();
57
58.4k
  }
58
59
13.4k
  ConstraintManager &getConstraintManager() {
60
13.4k
    return Eng.getConstraintManager();
61
13.4k
  }
62
63
586
  StoreManager &getStoreManager() {
64
586
    return Eng.getStoreManager();
65
586
  }
66
67
  /// Returns the previous node in the exploded graph, which includes
68
  /// the state of the program before the checker ran. Note, checkers should
69
  /// not retain the node in their state since the nodes might get invalidated.
70
149k
  ExplodedNode *getPredecessor() { return Pred; }
71
1.58M
  const ProgramStateRef &getState() const { return Pred->getState(); }
72
73
  /// Check if the checker changed the state of the execution; ex: added
74
  /// a new transition or a bug report.
75
2.01k
  bool isDifferent() { return Changed; }
76
77
  /// Returns the number of times the current block has been visited
78
  /// along the analyzed path.
79
3.37k
  unsigned blockCount() const {
80
3.37k
    return NB.getContext().blockCount();
81
3.37k
  }
82
83
283k
  ASTContext &getASTContext() {
84
283k
    return Eng.getContext();
85
283k
  }
86
87
222
  const LangOptions &getLangOpts() const {
88
222
    return Eng.getContext().getLangOpts();
89
222
  }
90
91
109k
  const LocationContext *getLocationContext() const {
92
109k
    return Pred->getLocationContext();
93
109k
  }
94
95
54.7k
  const StackFrameContext *getStackFrame() const {
96
54.7k
    return Pred->getStackFrame();
97
54.7k
  }
98
99
  /// Return true if the current LocationContext has no caller context.
100
8.71k
  bool inTopFrame() const { return getLocationContext()->inTopFrame();  }
101
102
10.2k
  BugReporter &getBugReporter() {
103
10.2k
    return Eng.getBugReporter();
104
10.2k
  }
105
106
1.44k
  SourceManager &getSourceManager() {
107
1.44k
    return getBugReporter().getSourceManager();
108
1.44k
  }
109
110
27.9k
  SValBuilder &getSValBuilder() {
111
27.9k
    return Eng.getSValBuilder();
112
27.9k
  }
113
114
1.35k
  SymbolManager &getSymbolManager() {
115
1.35k
    return getSValBuilder().getSymbolManager();
116
1.35k
  }
117
118
420
  ProgramStateManager &getStateManager() {
119
420
    return Eng.getStateManager();
120
420
  }
121
122
2.74k
  AnalysisDeclContext *getCurrentAnalysisDeclContext() const {
123
2.74k
    return Pred->getLocationContext()->getAnalysisDeclContext();
124
2.74k
  }
125
126
  /// Get the blockID.
127
444
  unsigned getBlockID() const {
128
444
    return NB.getContext().getBlock()->getBlockID();
129
444
  }
130
131
  /// If the given node corresponds to a PostStore program point,
132
  /// retrieve the location region as it was uttered in the code.
133
  ///
134
  /// This utility can be useful for generating extensive diagnostics, for
135
  /// example, for finding variables that the given symbol was assigned to.
136
6.52k
  static const MemRegion *getLocationRegionIfPostStore(const ExplodedNode *N) {
137
6.52k
    ProgramPoint L = N->getLocation();
138
6.52k
    if (Optional<PostStore> PSL = L.getAs<PostStore>())
139
338
      return reinterpret_cast<const MemRegion*>(PSL->getLocationValue());
140
6.19k
    return nullptr;
141
6.19k
  }
142
143
  /// Get the value of arbitrary expressions at this point in the path.
144
196k
  SVal getSVal(const Stmt *S) const {
145
196k
    return Pred->getSVal(S);
146
196k
  }
147
148
  /// Returns true if the value of \p E is greater than or equal to \p
149
  /// Val under unsigned comparison
150
  bool isGreaterOrEqual(const Expr *E, unsigned long long Val);
151
152
  /// Returns true if the value of \p E is negative.
153
  bool isNegative(const Expr *E);
154
155
  /// Generates a new transition in the program state graph
156
  /// (ExplodedGraph). Uses the default CheckerContext predecessor node.
157
  ///
158
  /// @param State The state of the generated node. If not specified, the state
159
  ///        will not be changed, but the new node will have the checker's tag.
160
  /// @param Tag The tag is used to uniquely identify the creation site. If no
161
  ///        tag is specified, a default tag, unique to the given checker,
162
  ///        will be used. Tags are used to prevent states generated at
163
  ///        different sites from caching out.
164
  ExplodedNode *addTransition(ProgramStateRef State = nullptr,
165
827k
                              const ProgramPointTag *Tag = nullptr) {
166
827k
    return addTransitionImpl(State ? 
State821k
:
getState()6.59k
, false, nullptr, Tag);
167
827k
  }
168
169
  /// Generates a new transition with the given predecessor.
170
  /// Allows checkers to generate a chain of nodes.
171
  ///
172
  /// @param State The state of the generated node.
173
  /// @param Pred The transition will be generated from the specified Pred node
174
  ///             to the newly generated node.
175
  /// @param Tag The tag to uniquely identify the creation site.
176
  ExplodedNode *addTransition(ProgramStateRef State,
177
                              ExplodedNode *Pred,
178
118k
                              const ProgramPointTag *Tag = nullptr) {
179
118k
    return addTransitionImpl(State, false, Pred, Tag);
180
118k
  }
181
182
  /// Generate a sink node. Generating a sink stops exploration of the
183
  /// given path. To create a sink node for the purpose of reporting an error,
184
  /// checkers should use generateErrorNode() instead.
185
  ExplodedNode *generateSink(ProgramStateRef State, ExplodedNode *Pred,
186
6.20k
                             const ProgramPointTag *Tag = nullptr) {
187
6.20k
    return addTransitionImpl(State ? 
State5.22k
:
getState()984
, true, Pred, Tag);
188
6.20k
  }
189
190
  /// Generate a transition to a node that will be used to report
191
  /// an error. This node will be a sink. That is, it will stop exploration of
192
  /// the given path.
193
  ///
194
  /// @param State The state of the generated node.
195
  /// @param Tag The tag to uniquely identify the creation site. If null,
196
  ///        the default tag for the checker will be used.
197
  ExplodedNode *generateErrorNode(ProgramStateRef State = nullptr,
198
2.54k
                                  const ProgramPointTag *Tag = nullptr) {
199
2.54k
    return generateSink(State, Pred,
200
2.54k
                       (Tag ? 
Tag46
:
Location.getTag()2.49k
));
201
2.54k
  }
202
203
  /// Generate a transition to a node that will be used to report
204
  /// an error. This node will not be a sink. That is, exploration will
205
  /// continue along this path.
206
  ///
207
  /// @param State The state of the generated node.
208
  /// @param Tag The tag to uniquely identify the creation site. If null,
209
  ///        the default tag for the checker will be used.
210
  ExplodedNode *
211
  generateNonFatalErrorNode(ProgramStateRef State = nullptr,
212
7.37k
                            const ProgramPointTag *Tag = nullptr) {
213
7.37k
    return addTransition(State, (Tag ? 
Tag378
:
Location.getTag()6.99k
));
214
7.37k
  }
215
216
  /// Emit the diagnostics report.
217
4.34k
  void emitReport(std::unique_ptr<BugReport> R) {
218
4.34k
    Changed = true;
219
4.34k
    Eng.getBugReporter().emitReport(std::move(R));
220
4.34k
  }
221
222
  /// Returns the word that should be used to refer to the declaration
223
  /// in the report.
224
  StringRef getDeclDescription(const Decl *D);
225
226
  /// Get the declaration of the called function (path-sensitive).
227
  const FunctionDecl *getCalleeDecl(const CallExpr *CE) const;
228
229
  /// Get the name of the called function (path-sensitive).
230
  StringRef getCalleeName(const FunctionDecl *FunDecl) const;
231
232
  /// Get the identifier of the called function (path-sensitive).
233
  const IdentifierInfo *getCalleeIdentifier(const CallExpr *CE) const {
234
    const FunctionDecl *FunDecl = getCalleeDecl(CE);
235
    if (FunDecl)
236
      return FunDecl->getIdentifier();
237
    else
238
      return nullptr;
239
  }
240
241
  /// Get the name of the called function (path-sensitive).
242
23.7k
  StringRef getCalleeName(const CallExpr *CE) const {
243
23.7k
    const FunctionDecl *FunDecl = getCalleeDecl(CE);
244
23.7k
    return getCalleeName(FunDecl);
245
23.7k
  }
246
247
  /// Returns true if the callee is an externally-visible function in the
248
  /// top-level namespace, such as \c malloc.
249
  ///
250
  /// If a name is provided, the function must additionally match the given
251
  /// name.
252
  ///
253
  /// Note that this deliberately excludes C++ library functions in the \c std
254
  /// namespace, but will include C library functions accessed through the
255
  /// \c std namespace. This also does not check if the function is declared
256
  /// as 'extern "C"', or if it uses C++ name mangling.
257
  static bool isCLibraryFunction(const FunctionDecl *FD,
258
                                 StringRef Name = StringRef());
259
260
  /// Depending on wither the location corresponds to a macro, return
261
  /// either the macro name or the token spelling.
262
  ///
263
  /// This could be useful when checkers' logic depends on whether a function
264
  /// is called with a given macro argument. For example:
265
  ///   s = socket(AF_INET,..)
266
  /// If AF_INET is a macro, the result should be treated as a source of taint.
267
  ///
268
  /// \sa clang::Lexer::getSpelling(), clang::Lexer::getImmediateMacroName().
269
  StringRef getMacroNameOrSpelling(SourceLocation &Loc);
270
271
private:
272
  ExplodedNode *addTransitionImpl(ProgramStateRef State,
273
                                 bool MarkAsSink,
274
                                 ExplodedNode *P = nullptr,
275
952k
                                 const ProgramPointTag *Tag = nullptr) {
276
952k
    // The analyzer may stop exploring if it sees a state it has previously
277
952k
    // visited ("cache out"). The early return here is a defensive check to
278
952k
    // prevent accidental caching out by checker API clients. Unless there is a
279
952k
    // tag or the client checker has requested that the generated node be
280
952k
    // marked as a sink, we assume that a client requesting a transition to a
281
952k
    // state that is the same as the predecessor state has made a mistake. We
282
952k
    // return the predecessor rather than cache out.
283
952k
    //
284
952k
    // TODO: We could potentially change the return to an assertion to alert
285
952k
    // clients to their mistake, but several checkers (including
286
952k
    // DereferenceChecker, CallAndMessageChecker, and DynamicTypePropagation)
287
952k
    // rely upon the defensive behavior and would need to be updated.
288
952k
    if (!State || (State == Pred->getState() && 
!Tag915k
&&
!MarkAsSink905k
))
289
904k
      return Pred;
290
47.6k
291
47.6k
    Changed = true;
292
47.6k
    const ProgramPoint &LocalLoc = (Tag ? 
Location.withTag(Tag)10.7k
:
Location36.9k
);
293
47.6k
    if (!P)
294
38.8k
      P = Pred;
295
47.6k
296
47.6k
    ExplodedNode *node;
297
47.6k
    if (MarkAsSink)
298
6.20k
      node = NB.generateSink(LocalLoc, State, P);
299
41.4k
    else
300
41.4k
      node = NB.generateNode(LocalLoc, State, P);
301
47.6k
    return node;
302
47.6k
  }
303
};
304
305
} // end GR namespace
306
307
} // end clang namespace
308
309
#endif