/Users/buildslave/jenkins/workspace/coverage/llvm-project/clang/include/clang/StaticAnalyzer/Checkers/SValExplainer.h
Line | Count | Source (jump to first uncovered line) |
1 | | //== SValExplainer.h - Symbolic value explainer -----------------*- C++ -*--==// |
2 | | // |
3 | | // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. |
4 | | // See https://llvm.org/LICENSE.txt for license information. |
5 | | // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception |
6 | | // |
7 | | //===----------------------------------------------------------------------===// |
8 | | // |
9 | | // This file defines SValExplainer, a class for pretty-printing a |
10 | | // human-readable description of a symbolic value. For example, |
11 | | // "reg_$0<x>" is turned into "initial value of variable 'x'". |
12 | | // |
13 | | //===----------------------------------------------------------------------===// |
14 | | |
15 | | #ifndef LLVM_CLANG_STATICANALYZER_CHECKERS_SVALEXPLAINER_H |
16 | | #define LLVM_CLANG_STATICANALYZER_CHECKERS_SVALEXPLAINER_H |
17 | | |
18 | | #include "clang/AST/Attr.h" |
19 | | #include "clang/AST/DeclCXX.h" |
20 | | #include "clang/StaticAnalyzer/Core/PathSensitive/SValVisitor.h" |
21 | | #include "llvm/ADT/StringExtras.h" |
22 | | |
23 | | namespace clang { |
24 | | |
25 | | namespace ento { |
26 | | |
27 | | class SValExplainer : public FullSValVisitor<SValExplainer, std::string> { |
28 | | private: |
29 | | ASTContext &ACtx; |
30 | | |
31 | 10 | std::string printStmt(const Stmt *S) { |
32 | 10 | std::string Str; |
33 | 10 | llvm::raw_string_ostream OS(Str); |
34 | 10 | S->printPretty(OS, nullptr, PrintingPolicy(ACtx.getLangOpts())); |
35 | 10 | return Str; |
36 | 10 | } |
37 | | |
38 | 15 | bool isThisObject(const SymbolicRegion *R) { |
39 | 15 | if (auto S = dyn_cast<SymbolRegionValue>(R->getSymbol())) |
40 | 11 | if (isa<CXXThisRegion>(S->getRegion())) |
41 | 3 | return true; |
42 | 12 | return false; |
43 | 15 | } |
44 | | |
45 | | public: |
46 | 61 | SValExplainer(ASTContext &Ctx) : ACtx(Ctx) {} |
47 | | |
48 | 0 | std::string VisitUnknownVal(UnknownVal V) { |
49 | 0 | return "unknown value"; |
50 | 0 | } |
51 | | |
52 | 1 | std::string VisitUndefinedVal(UndefinedVal V) { |
53 | 1 | return "undefined value"; |
54 | 1 | } |
55 | | |
56 | 39 | std::string VisitLocMemRegionVal(loc::MemRegionVal V) { |
57 | 39 | const MemRegion *R = V.getRegion(); |
58 | | // Avoid the weird "pointer to pointee of ...". |
59 | 39 | if (auto SR = dyn_cast<SymbolicRegion>(R)) { |
60 | | // However, "pointer to 'this' object" is fine. |
61 | 8 | if (!isThisObject(SR)) |
62 | 7 | return Visit(SR->getSymbol()); |
63 | 8 | } |
64 | 32 | return "pointer to " + Visit(R); |
65 | 39 | } |
66 | | |
67 | 2 | std::string VisitLocConcreteInt(loc::ConcreteInt V) { |
68 | 2 | const llvm::APSInt &I = V.getValue(); |
69 | 2 | std::string Str; |
70 | 2 | llvm::raw_string_ostream OS(Str); |
71 | 2 | OS << "concrete memory address '" << I << "'"; |
72 | 2 | return Str; |
73 | 2 | } |
74 | | |
75 | 15 | std::string VisitNonLocSymbolVal(nonloc::SymbolVal V) { |
76 | 15 | return Visit(V.getSymbol()); |
77 | 15 | } |
78 | | |
79 | 3 | std::string VisitNonLocConcreteInt(nonloc::ConcreteInt V) { |
80 | 3 | const llvm::APSInt &I = V.getValue(); |
81 | 3 | std::string Str; |
82 | 3 | llvm::raw_string_ostream OS(Str); |
83 | 3 | OS << (I.isSigned() ? "signed " : "unsigned "0 ) << I.getBitWidth() |
84 | 3 | << "-bit integer '" << I << "'"; |
85 | 3 | return Str; |
86 | 3 | } |
87 | | |
88 | 2 | std::string VisitNonLocLazyCompoundVal(nonloc::LazyCompoundVal V) { |
89 | 2 | return "lazily frozen compound value of " + Visit(V.getRegion()); |
90 | 2 | } |
91 | | |
92 | 19 | std::string VisitSymbolRegionValue(const SymbolRegionValue *S) { |
93 | 19 | const MemRegion *R = S->getRegion(); |
94 | | // Special handling for argument values. |
95 | 19 | if (auto V = dyn_cast<VarRegion>(R)) |
96 | 15 | if (auto D = dyn_cast<ParmVarDecl>(V->getDecl())) |
97 | 14 | return "argument '" + D->getQualifiedNameAsString() + "'"; |
98 | 5 | return "initial value of " + Visit(R); |
99 | 19 | } |
100 | | |
101 | 7 | std::string VisitSymbolConjured(const SymbolConjured *S) { |
102 | 7 | return "symbol of type '" + S->getType().getAsString() + |
103 | 7 | "' conjured at statement '" + printStmt(S->getStmt()) + "'"; |
104 | 7 | } |
105 | | |
106 | 3 | std::string VisitSymbolDerived(const SymbolDerived *S) { |
107 | 3 | return "value derived from (" + Visit(S->getParentSymbol()) + |
108 | 3 | ") for " + Visit(S->getRegion()); |
109 | 3 | } |
110 | | |
111 | 1 | std::string VisitSymbolExtent(const SymbolExtent *S) { |
112 | 1 | return "extent of " + Visit(S->getRegion()); |
113 | 1 | } |
114 | | |
115 | 1 | std::string VisitSymbolMetadata(const SymbolMetadata *S) { |
116 | 1 | return "metadata of type '" + S->getType().getAsString() + "' tied to " + |
117 | 1 | Visit(S->getRegion()); |
118 | 1 | } |
119 | | |
120 | 3 | std::string VisitSymIntExpr(const SymIntExpr *S) { |
121 | 3 | std::string Str; |
122 | 3 | llvm::raw_string_ostream OS(Str); |
123 | 3 | OS << "(" << Visit(S->getLHS()) << ") " |
124 | 3 | << std::string(BinaryOperator::getOpcodeStr(S->getOpcode())) << " " |
125 | 3 | << S->getRHS(); |
126 | 3 | return Str; |
127 | 3 | } |
128 | | |
129 | | // TODO: IntSymExpr doesn't appear in practice. |
130 | | // Add the relevant code once it does. |
131 | | |
132 | 1 | std::string VisitSymSymExpr(const SymSymExpr *S) { |
133 | 1 | return "(" + Visit(S->getLHS()) + ") " + |
134 | 1 | std::string(BinaryOperator::getOpcodeStr(S->getOpcode())) + |
135 | 1 | " (" + Visit(S->getRHS()) + ")"; |
136 | 1 | } |
137 | | |
138 | | // TODO: SymbolCast doesn't appear in practice. |
139 | | // Add the relevant code once it does. |
140 | | |
141 | 7 | std::string VisitSymbolicRegion(const SymbolicRegion *R) { |
142 | | // Explain 'this' object here. |
143 | | // TODO: Explain CXXThisRegion itself, find a way to test it. |
144 | 7 | if (isThisObject(R)) |
145 | 2 | return "'this' object"; |
146 | | // Objective-C objects are not normal symbolic regions. At least, |
147 | | // they're always on the heap. |
148 | 5 | if (R->getSymbol()->getType() |
149 | 5 | .getCanonicalType()->getAs<ObjCObjectPointerType>()) |
150 | 2 | return "object at " + Visit(R->getSymbol()); |
151 | | // Other heap-based symbolic regions are also special. |
152 | 3 | if (isa<HeapSpaceRegion>(R->getMemorySpace())) |
153 | 1 | return "heap segment that starts at " + Visit(R->getSymbol()); |
154 | 2 | return "pointee of " + Visit(R->getSymbol()); |
155 | 3 | } |
156 | | |
157 | 1 | std::string VisitAllocaRegion(const AllocaRegion *R) { |
158 | 1 | return "region allocated by '" + printStmt(R->getExpr()) + "'"; |
159 | 1 | } |
160 | | |
161 | 0 | std::string VisitCompoundLiteralRegion(const CompoundLiteralRegion *R) { |
162 | 0 | return "compound literal " + printStmt(R->getLiteralExpr()); |
163 | 0 | } |
164 | | |
165 | 1 | std::string VisitStringRegion(const StringRegion *R) { |
166 | 1 | return "string literal " + R->getString(); |
167 | 1 | } |
168 | | |
169 | 6 | std::string VisitElementRegion(const ElementRegion *R) { |
170 | 6 | std::string Str; |
171 | 6 | llvm::raw_string_ostream OS(Str); |
172 | 6 | OS << "element of type '" << R->getElementType() << "' with index "; |
173 | | // For concrete index: omit type of the index integer. |
174 | 6 | if (auto I = R->getIndex().getAs<nonloc::ConcreteInt>()) |
175 | 5 | OS << I->getValue(); |
176 | 1 | else |
177 | 1 | OS << "'" << Visit(R->getIndex()) << "'"; |
178 | 6 | OS << " of " + Visit(R->getSuperRegion()); |
179 | 6 | return Str; |
180 | 6 | } |
181 | | |
182 | 26 | std::string VisitNonParamVarRegion(const NonParamVarRegion *R) { |
183 | 26 | const VarDecl *VD = R->getDecl(); |
184 | 26 | std::string Name = VD->getQualifiedNameAsString(); |
185 | 26 | if (isa<ParmVarDecl>(VD)) |
186 | 16 | return "parameter '" + Name + "'"; |
187 | 10 | else if (VD->hasAttr<BlocksAttr>()) |
188 | 2 | return "block variable '" + Name + "'"; |
189 | 8 | else if (VD->hasLocalStorage()) |
190 | 1 | return "local variable '" + Name + "'"; |
191 | 7 | else if (VD->isStaticLocal()) |
192 | 1 | return "static local variable '" + Name + "'"; |
193 | 6 | else if (VD->hasGlobalStorage()) |
194 | 6 | return "global variable '" + Name + "'"; |
195 | 0 | else |
196 | 0 | llvm_unreachable("A variable is either local or global"); |
197 | 26 | } |
198 | | |
199 | 2 | std::string VisitObjCIvarRegion(const ObjCIvarRegion *R) { |
200 | 2 | return "instance variable '" + R->getDecl()->getNameAsString() + "' of " + |
201 | 2 | Visit(R->getSuperRegion()); |
202 | 2 | } |
203 | | |
204 | 6 | std::string VisitFieldRegion(const FieldRegion *R) { |
205 | 6 | return "field '" + R->getDecl()->getNameAsString() + "' of " + |
206 | 6 | Visit(R->getSuperRegion()); |
207 | 6 | } |
208 | | |
209 | 2 | std::string VisitCXXTempObjectRegion(const CXXTempObjectRegion *R) { |
210 | 2 | return "temporary object constructed at statement '" + |
211 | 2 | printStmt(R->getExpr()) + "'"; |
212 | 2 | } |
213 | | |
214 | 1 | std::string VisitCXXBaseObjectRegion(const CXXBaseObjectRegion *R) { |
215 | 1 | return "base object '" + R->getDecl()->getQualifiedNameAsString() + |
216 | 1 | "' inside " + Visit(R->getSuperRegion()); |
217 | 1 | } |
218 | | |
219 | 7 | std::string VisitParamVarRegion(const ParamVarRegion *R) { |
220 | 7 | std::string Str; |
221 | 7 | llvm::raw_string_ostream OS(Str); |
222 | | |
223 | 7 | const ParmVarDecl *PVD = R->getDecl(); |
224 | 7 | std::string Name = PVD->getQualifiedNameAsString(); |
225 | 7 | if (!Name.empty()) { |
226 | 6 | OS << "parameter '" << Name << "'"; |
227 | 6 | return std::string(OS.str()); |
228 | 6 | } |
229 | | |
230 | 1 | unsigned Index = R->getIndex() + 1; |
231 | 1 | OS << Index << llvm::getOrdinalSuffix(Index) << " parameter of "; |
232 | 1 | const Decl *Parent = R->getStackFrame()->getDecl(); |
233 | 1 | if (const auto *FD = dyn_cast<FunctionDecl>(Parent)) |
234 | 1 | OS << "function '" << FD->getQualifiedNameAsString() << "()'"; |
235 | 0 | else if (const auto *CD = dyn_cast<CXXConstructorDecl>(Parent)) |
236 | 0 | OS << "C++ constructor '" << CD->getQualifiedNameAsString() << "()'"; |
237 | 0 | else if (const auto *MD = dyn_cast<ObjCMethodDecl>(Parent)) { |
238 | 0 | if (MD->isClassMethod()) |
239 | 0 | OS << "Objective-C method '+" << MD->getQualifiedNameAsString() << "'"; |
240 | 0 | else |
241 | 0 | OS << "Objective-C method '-" << MD->getQualifiedNameAsString() << "'"; |
242 | 0 | } else if (isa<BlockDecl>(Parent)) { |
243 | 0 | if (cast<BlockDecl>(Parent)->isConversionFromLambda()) |
244 | 0 | OS << "lambda"; |
245 | 0 | else |
246 | 0 | OS << "block"; |
247 | 0 | } |
248 | | |
249 | 1 | return std::string(OS.str()); |
250 | 7 | } |
251 | | |
252 | 0 | std::string VisitSVal(SVal V) { |
253 | 0 | std::string Str; |
254 | 0 | llvm::raw_string_ostream OS(Str); |
255 | 0 | OS << V; |
256 | 0 | return "a value unsupported by the explainer: (" + |
257 | 0 | std::string(OS.str()) + ")"; |
258 | 0 | } |
259 | | |
260 | 0 | std::string VisitSymExpr(SymbolRef S) { |
261 | 0 | std::string Str; |
262 | 0 | llvm::raw_string_ostream OS(Str); |
263 | 0 | S->dumpToStream(OS); |
264 | 0 | return "a symbolic expression unsupported by the explainer: (" + |
265 | 0 | std::string(OS.str()) + ")"; |
266 | 0 | } |
267 | | |
268 | 0 | std::string VisitMemRegion(const MemRegion *R) { |
269 | 0 | std::string Str; |
270 | 0 | llvm::raw_string_ostream OS(Str); |
271 | 0 | OS << R; |
272 | 0 | return "a memory region unsupported by the explainer (" + |
273 | 0 | std::string(OS.str()) + ")"; |
274 | 0 | } |
275 | | }; |
276 | | |
277 | | } // end namespace ento |
278 | | |
279 | | } // end namespace clang |
280 | | |
281 | | #endif |