Coverage Report

Created: 2019-07-24 05:18

/Users/buildslave/jenkins/workspace/clang-stage2-coverage-R/llvm/tools/clang/lib/StaticAnalyzer/Checkers/BuiltinFunctionChecker.cpp
Line
Count
Source (jump to first uncovered line)
1
//=== BuiltinFunctionChecker.cpp --------------------------------*- C++ -*-===//
2
//
3
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4
// See https://llvm.org/LICENSE.txt for license information.
5
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6
//
7
//===----------------------------------------------------------------------===//
8
//
9
// This checker evaluates clang builtin functions.
10
//
11
//===----------------------------------------------------------------------===//
12
13
#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
14
#include "clang/Basic/Builtins.h"
15
#include "clang/StaticAnalyzer/Core/Checker.h"
16
#include "clang/StaticAnalyzer/Core/CheckerManager.h"
17
#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
18
#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
19
20
using namespace clang;
21
using namespace ento;
22
23
namespace {
24
25
class BuiltinFunctionChecker : public Checker<eval::Call> {
26
public:
27
  bool evalCall(const CallEvent &Call, CheckerContext &C) const;
28
};
29
30
}
31
32
bool BuiltinFunctionChecker::evalCall(const CallEvent &Call,
33
49.5k
                                      CheckerContext &C) const {
34
49.5k
  ProgramStateRef state = C.getState();
35
49.5k
  const auto *FD = dyn_cast_or_null<FunctionDecl>(Call.getDecl());
36
49.5k
  if (!FD)
37
198
    return false;
38
49.3k
39
49.3k
  const LocationContext *LCtx = C.getLocationContext();
40
49.3k
  const Expr *CE = Call.getOriginExpr();
41
49.3k
42
49.3k
  switch (FD->getBuiltinID()) {
43
49.3k
  default:
44
49.2k
    return false;
45
49.3k
46
49.3k
  case Builtin::BI__builtin_assume: {
47
7
    assert (Call.getNumArgs() > 0);
48
7
    SVal Arg = Call.getArgSVal(0);
49
7
    if (Arg.isUndef())
50
0
      return true; // Return true to model purity.
51
7
52
7
    state = state->assume(Arg.castAs<DefinedOrUnknownSVal>(), true);
53
7
    // FIXME: do we want to warn here? Not right now. The most reports might
54
7
    // come from infeasible paths, thus being false positives.
55
7
    if (!state) {
56
2
      C.generateSink(C.getState(), C.getPredecessor());
57
2
      return true;
58
2
    }
59
5
60
5
    C.addTransition(state);
61
5
    return true;
62
5
  }
63
5
64
26
  case Builtin::BI__builtin_unpredictable:
65
26
  case Builtin::BI__builtin_expect:
66
26
  case Builtin::BI__builtin_assume_aligned:
67
26
  case Builtin::BI__builtin_addressof: {
68
26
    // For __builtin_unpredictable, __builtin_expect, and
69
26
    // __builtin_assume_aligned, just return the value of the subexpression.
70
26
    // __builtin_addressof is going from a reference to a pointer, but those
71
26
    // are represented the same way in the analyzer.
72
26
    assert (Call.getNumArgs() > 0);
73
26
    SVal Arg = Call.getArgSVal(0);
74
26
    C.addTransition(state->BindExpr(CE, LCtx, Arg));
75
26
    return true;
76
26
  }
77
26
78
91
  case Builtin::BI__builtin_alloca_with_align:
79
91
  case Builtin::BI__builtin_alloca: {
80
91
    // FIXME: Refactor into StoreManager itself?
81
91
    MemRegionManager& RM = C.getStoreManager().getRegionManager();
82
91
    const AllocaRegion* R =
83
91
      RM.getAllocaRegion(CE, C.blockCount(), C.getLocationContext());
84
91
85
91
    // Set the extent of the region in bytes. This enables us to use the
86
91
    // SVal of the argument directly. If we save the extent in bits, we
87
91
    // cannot represent values like symbol*8.
88
91
    auto Size = Call.getArgSVal(0);
89
91
    if (Size.isUndef())
90
0
      return true; // Return true to model purity.
91
91
92
91
    SValBuilder& svalBuilder = C.getSValBuilder();
93
91
    DefinedOrUnknownSVal Extent = R->getExtent(svalBuilder);
94
91
    DefinedOrUnknownSVal extentMatchesSizeArg =
95
91
      svalBuilder.evalEQ(state, Extent, Size.castAs<DefinedOrUnknownSVal>());
96
91
    state = state->assume(extentMatchesSizeArg, true);
97
91
    assert(state && "The region should not have any previous constraints");
98
91
99
91
    C.addTransition(state->BindExpr(CE, LCtx, loc::MemRegionVal(R)));
100
91
    return true;
101
91
  }
102
91
103
91
  case Builtin::BI__builtin_dynamic_object_size:
104
29
  case Builtin::BI__builtin_object_size:
105
29
  case Builtin::BI__builtin_constant_p: {
106
29
    // This must be resolvable at compile time, so we defer to the constant
107
29
    // evaluator for a value.
108
29
    SValBuilder &SVB = C.getSValBuilder();
109
29
    SVal V = UnknownVal();
110
29
    Expr::EvalResult EVResult;
111
29
    if (CE->EvaluateAsInt(EVResult, C.getASTContext(), Expr::SE_NoSideEffects)) {
112
22
      // Make sure the result has the correct type.
113
22
      llvm::APSInt Result = EVResult.Val.getInt();
114
22
      BasicValueFactory &BVF = SVB.getBasicValueFactory();
115
22
      BVF.getAPSIntType(CE->getType()).apply(Result);
116
22
      V = SVB.makeIntVal(Result);
117
22
    }
118
29
119
29
    if (FD->getBuiltinID() == Builtin::BI__builtin_constant_p) {
120
13
      // If we didn't manage to figure out if the value is constant or not,
121
13
      // it is safe to assume that it's not constant and unsafe to assume
122
13
      // that it's constant.
123
13
      if (V.isUnknown())
124
5
        V = SVB.makeIntVal(0, CE->getType());
125
13
    }
126
29
127
29
    C.addTransition(state->BindExpr(CE, LCtx, V));
128
29
    return true;
129
29
  }
130
49.3k
  }
131
49.3k
}
132
133
685
void ento::registerBuiltinFunctionChecker(CheckerManager &mgr) {
134
685
  mgr.registerChecker<BuiltinFunctionChecker>();
135
685
}
136
137
686
bool ento::shouldRegisterBuiltinFunctionChecker(const LangOptions &LO) {
138
686
  return true;
139
686
}