clang  3.7.0
BugReporterVisitor.h
Go to the documentation of this file.
1 //===--- BugReporterVisitor.h - Generate PathDiagnostics -------*- C++ -*-===//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This file declares BugReporterVisitors, which are used to generate enhanced
11 // diagnostic traces.
12 //
13 //===----------------------------------------------------------------------===//
14 
15 #ifndef LLVM_CLANG_STATICANALYZER_CORE_BUGREPORTER_BUGREPORTERVISITOR_H
16 #define LLVM_CLANG_STATICANALYZER_CORE_BUGREPORTER_BUGREPORTERVISITOR_H
17 
19 #include "llvm/ADT/FoldingSet.h"
20 
21 namespace clang {
22 
23 namespace ento {
24 
25 class BugReport;
26 class BugReporterContext;
27 class ExplodedNode;
28 class MemRegion;
29 class PathDiagnosticPiece;
30 
31 /// \brief BugReporterVisitors are used to add custom diagnostics along a path.
32 ///
33 /// Custom visitors should subclass the BugReporterVisitorImpl class for a
34 /// default implementation of the clone() method.
35 /// (Warning: if you have a deep subclass of BugReporterVisitorImpl, the
36 /// default implementation of clone() will NOT do the right thing, and you
37 /// will have to provide your own implementation.)
38 class BugReporterVisitor : public llvm::FoldingSetNode {
39 public:
40  virtual ~BugReporterVisitor();
41 
42  /// \brief Returns a copy of this BugReporter.
43  ///
44  /// Custom BugReporterVisitors should not override this method directly.
45  /// Instead, they should inherit from BugReporterVisitorImpl and provide
46  /// a protected or public copy constructor.
47  ///
48  /// (Warning: if you have a deep subclass of BugReporterVisitorImpl, the
49  /// default implementation of clone() will NOT do the right thing, and you
50  /// will have to provide your own implementation.)
51  virtual std::unique_ptr<BugReporterVisitor> clone() const = 0;
52 
53  /// \brief Return a diagnostic piece which should be associated with the
54  /// given node.
55  ///
56  /// The last parameter can be used to register a new visitor with the given
57  /// BugReport while processing a node.
58  virtual PathDiagnosticPiece *VisitNode(const ExplodedNode *Succ,
59  const ExplodedNode *Pred,
60  BugReporterContext &BRC,
61  BugReport &BR) = 0;
62 
63  /// \brief Provide custom definition for the final diagnostic piece on the
64  /// path - the piece, which is displayed before the path is expanded.
65  ///
66  /// If returns NULL the default implementation will be used.
67  /// Also note that at most one visitor of a BugReport should generate a
68  /// non-NULL end of path diagnostic piece.
69  virtual std::unique_ptr<PathDiagnosticPiece>
71 
72  virtual void Profile(llvm::FoldingSetNodeID &ID) const = 0;
73 
74  /// \brief Generates the default final diagnostic piece.
75  static std::unique_ptr<PathDiagnosticPiece>
77  BugReport &BR);
78 };
79 
80 /// This class provides a convenience implementation for clone() using the
81 /// Curiously-Recurring Template Pattern. If you are implementing a custom
82 /// BugReporterVisitor, subclass BugReporterVisitorImpl and provide a public
83 /// or protected copy constructor.
84 ///
85 /// (Warning: if you have a deep subclass of BugReporterVisitorImpl, the
86 /// default implementation of clone() will NOT do the right thing, and you
87 /// will have to provide your own implementation.)
88 template <class DERIVED>
90  std::unique_ptr<BugReporterVisitor> clone() const override {
91  return llvm::make_unique<DERIVED>(*static_cast<const DERIVED *>(this));
92  }
93 };
94 
96  : public BugReporterVisitorImpl<FindLastStoreBRVisitor>
97 {
98  const MemRegion *R;
99  SVal V;
100  bool Satisfied;
101 
102  /// If the visitor is tracking the value directly responsible for the
103  /// bug, we are going to employ false positive suppression.
104  bool EnableNullFPSuppression;
105 
106 public:
107  /// Creates a visitor for every VarDecl inside a Stmt and registers it with
108  /// the BugReport.
109  static void registerStatementVarDecls(BugReport &BR, const Stmt *S,
110  bool EnableNullFPSuppression);
111 
113  bool InEnableNullFPSuppression)
114  : R(R),
115  V(V),
116  Satisfied(false),
117  EnableNullFPSuppression(InEnableNullFPSuppression) {}
118 
119  void Profile(llvm::FoldingSetNodeID &ID) const override;
120 
122  const ExplodedNode *PrevN,
123  BugReporterContext &BRC,
124  BugReport &BR) override;
125 };
126 
128  : public BugReporterVisitorImpl<TrackConstraintBRVisitor>
129 {
130  DefinedSVal Constraint;
131  bool Assumption;
132  bool IsSatisfied;
133  bool IsZeroCheck;
134 
135  /// We should start tracking from the last node along the path in which the
136  /// value is constrained.
137  bool IsTrackingTurnedOn;
138 
139 public:
140  TrackConstraintBRVisitor(DefinedSVal constraint, bool assumption)
141  : Constraint(constraint), Assumption(assumption), IsSatisfied(false),
142  IsZeroCheck(!Assumption && Constraint.getAs<Loc>()),
143  IsTrackingTurnedOn(false) {}
144 
145  void Profile(llvm::FoldingSetNodeID &ID) const override;
146 
147  /// Return the tag associated with this visitor. This tag will be used
148  /// to make all PathDiagnosticPieces created by this visitor.
149  static const char *getTag();
150 
152  const ExplodedNode *PrevN,
153  BugReporterContext &BRC,
154  BugReport &BR) override;
155 
156 private:
157  /// Checks if the constraint is valid in the current state.
158  bool isUnderconstrained(const ExplodedNode *N) const;
159 
160 };
161 
162 /// \class NilReceiverBRVisitor
163 /// \brief Prints path notes when a message is sent to a nil receiver.
165  : public BugReporterVisitorImpl<NilReceiverBRVisitor> {
166 public:
167 
168  void Profile(llvm::FoldingSetNodeID &ID) const override {
169  static int x = 0;
170  ID.AddPointer(&x);
171  }
172 
174  const ExplodedNode *PrevN,
175  BugReporterContext &BRC,
176  BugReport &BR) override;
177 
178  /// If the statement is a message send expression with nil receiver, returns
179  /// the receiver expression. Returns NULL otherwise.
180  static const Expr *getNilReceiver(const Stmt *S, const ExplodedNode *N);
181 };
182 
183 /// Visitor that tries to report interesting diagnostics from conditions.
184 class ConditionBRVisitor : public BugReporterVisitorImpl<ConditionBRVisitor> {
185 public:
186  void Profile(llvm::FoldingSetNodeID &ID) const override {
187  static int x = 0;
188  ID.AddPointer(&x);
189  }
190 
191  /// Return the tag associated with this visitor. This tag will be used
192  /// to make all PathDiagnosticPieces created by this visitor.
193  static const char *getTag();
194 
196  const ExplodedNode *Prev,
197  BugReporterContext &BRC,
198  BugReport &BR) override;
199 
201  const ExplodedNode *Prev,
202  BugReporterContext &BRC,
203  BugReport &BR);
204 
206  const ExplodedNode *N,
207  const CFGBlock *srcBlk,
208  const CFGBlock *dstBlk,
209  BugReport &R,
210  BugReporterContext &BRC);
211 
213  bool tookTrue,
214  BugReporterContext &BRC,
215  BugReport &R,
216  const ExplodedNode *N);
217 
219  const DeclRefExpr *DR,
220  const bool tookTrue,
221  BugReporterContext &BRC,
222  BugReport &R,
223  const ExplodedNode *N);
224 
226  const BinaryOperator *BExpr,
227  const bool tookTrue,
228  BugReporterContext &BRC,
229  BugReport &R,
230  const ExplodedNode *N);
231 
232  PathDiagnosticPiece *VisitConditionVariable(StringRef LhsString,
233  const Expr *CondVarExpr,
234  const bool tookTrue,
235  BugReporterContext &BRC,
236  BugReport &R,
237  const ExplodedNode *N);
238 
239  bool patternMatch(const Expr *Ex,
240  raw_ostream &Out,
241  BugReporterContext &BRC,
242  BugReport &R,
243  const ExplodedNode *N,
244  Optional<bool> &prunable);
245 };
246 
247 /// \brief Suppress reports that might lead to known false positives.
248 ///
249 /// Currently this suppresses reports based on locations of bugs.
251  : public BugReporterVisitorImpl<LikelyFalsePositiveSuppressionBRVisitor> {
252 public:
253  static void *getTag() {
254  static int Tag = 0;
255  return static_cast<void *>(&Tag);
256  }
257 
258  void Profile(llvm::FoldingSetNodeID &ID) const override {
259  ID.AddPointer(getTag());
260  }
261 
263  const ExplodedNode *Prev,
264  BugReporterContext &BRC,
265  BugReport &BR) override {
266  return nullptr;
267  }
268 
269  std::unique_ptr<PathDiagnosticPiece> getEndPath(BugReporterContext &BRC,
270  const ExplodedNode *N,
271  BugReport &BR) override;
272 };
273 
274 /// \brief When a region containing undefined value or '0' value is passed
275 /// as an argument in a call, marks the call as interesting.
276 ///
277 /// As a result, BugReporter will not prune the path through the function even
278 /// if the region's contents are not modified/accessed by the call.
280  : public BugReporterVisitorImpl<UndefOrNullArgVisitor> {
281 
282  /// The interesting memory region this visitor is tracking.
283  const MemRegion *R;
284 
285 public:
286  UndefOrNullArgVisitor(const MemRegion *InR) : R(InR) {}
287 
288  void Profile(llvm::FoldingSetNodeID &ID) const override {
289  static int Tag = 0;
290  ID.AddPointer(&Tag);
291  ID.AddPointer(R);
292  }
293 
295  const ExplodedNode *PrevN,
296  BugReporterContext &BRC,
297  BugReport &BR) override;
298 };
299 
301 : public BugReporterVisitorImpl<SuppressInlineDefensiveChecksVisitor>
302 {
303  /// The symbolic value for which we are tracking constraints.
304  /// This value is constrained to null in the end of path.
305  DefinedSVal V;
306 
307  /// Track if we found the node where the constraint was first added.
308  bool IsSatisfied;
309 
310  /// Since the visitors can be registered on nodes previous to the last
311  /// node in the BugReport, but the path traversal always starts with the last
312  /// node, the visitor invariant (that we start with a node in which V is null)
313  /// might not hold when node visitation starts. We are going to start tracking
314  /// from the last node in which the value is null.
315  bool IsTrackingTurnedOn;
316 
317 public:
319 
320  void Profile(llvm::FoldingSetNodeID &ID) const override;
321 
322  /// Return the tag associated with this visitor. This tag will be used
323  /// to make all PathDiagnosticPieces created by this visitor.
324  static const char *getTag();
325 
327  const ExplodedNode *Pred,
328  BugReporterContext &BRC,
329  BugReport &BR) override;
330 };
331 
332 namespace bugreporter {
333 
334 /// Attempts to add visitors to trace a null or undefined value back to its
335 /// point of origin, whether it is a symbol constrained to null or an explicit
336 /// assignment.
337 ///
338 /// \param N A node "downstream" from the evaluation of the statement.
339 /// \param S The statement whose value is null or undefined.
340 /// \param R The bug report to which visitors should be attached.
341 /// \param IsArg Whether the statement is an argument to an inlined function.
342 /// If this is the case, \p N \em must be the CallEnter node for
343 /// the function.
344 /// \param EnableNullFPSuppression Whether we should employ false positive
345 /// suppression (inlined defensive checks, returned null).
346 ///
347 /// \return Whether or not the function was able to add visitors for this
348 /// statement. Note that returning \c true does not actually imply
349 /// that any visitors were added.
350 bool trackNullOrUndefValue(const ExplodedNode *N, const Stmt *S, BugReport &R,
351  bool IsArg = false,
352  bool EnableNullFPSuppression = true);
353 
354 const Expr *getDerefExpr(const Stmt *S);
355 const Stmt *GetDenomExpr(const ExplodedNode *N);
356 const Stmt *GetRetValExpr(const ExplodedNode *N);
357 bool isDeclRefExprToReference(const Expr *E);
358 
359 
360 } // end namespace clang
361 } // end namespace ento
362 } // end namespace bugreporter
363 
364 
365 #endif
const Expr * getDerefExpr(const Stmt *S)
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:77
UndefOrNullArgVisitor(const MemRegion *InR)
PathDiagnosticPiece * VisitNode(const ExplodedNode *N, const ExplodedNode *PrevN, BugReporterContext &BRC, BugReport &BR) override
Return a diagnostic piece which should be associated with the given node.
PathDiagnosticPiece * VisitNode(const ExplodedNode *N, const ExplodedNode *Prev, BugReporterContext &BRC, BugReport &BR) override
Return a diagnostic piece which should be associated with the given node.
virtual void Profile(llvm::FoldingSetNodeID &ID) const =0
TrackConstraintBRVisitor(DefinedSVal constraint, bool assumption)
PathDiagnosticPiece * VisitNode(const ExplodedNode *N, const ExplodedNode *PrevN, BugReporterContext &BRC, BugReport &BR) override
Return a diagnostic piece which should be associated with the given node.
void Profile(llvm::FoldingSetNodeID &ID) const override
PathDiagnosticPiece * VisitNode(const ExplodedNode *N, const ExplodedNode *Prev, BugReporterContext &BRC, BugReport &BR) override
Return a diagnostic piece which should be associated with the given node.
Prints path notes when a message is sent to a nil receiver.
const Stmt * GetDenomExpr(const ExplodedNode *N)
Visitor that tries to report interesting diagnostics from conditions.
void Profile(llvm::FoldingSetNodeID &ID) const override
bool patternMatch(const Expr *Ex, raw_ostream &Out, BugReporterContext &BRC, BugReport &R, const ExplodedNode *N, Optional< bool > &prunable)
std::unique_ptr< PathDiagnosticPiece > getEndPath(BugReporterContext &BRC, const ExplodedNode *N, BugReport &BR) override
Provide custom definition for the final diagnostic piece on the path - the piece, which is displayed ...
virtual std::unique_ptr< PathDiagnosticPiece > getEndPath(BugReporterContext &BRC, const ExplodedNode *N, BugReport &BR)
Provide custom definition for the final diagnostic piece on the path - the piece, which is displayed ...
void Profile(llvm::FoldingSetNodeID &ID) const override
A builtin binary operation expression such as "x + y" or "x <= y".
Definition: Expr.h:2918
virtual PathDiagnosticPiece * VisitNode(const ExplodedNode *Succ, const ExplodedNode *Pred, BugReporterContext &BRC, BugReport &BR)=0
Return a diagnostic piece which should be associated with the given node.
static void registerStatementVarDecls(BugReport &BR, const Stmt *S, bool EnableNullFPSuppression)
When a region containing undefined value or '0' value is passed as an argument in a call...
void Profile(llvm::FoldingSetNodeID &ID) const override
void Profile(llvm::FoldingSetNodeID &ID) const override
ID
Defines the set of possible language-specific address spaces.
Definition: AddressSpaces.h:27
static const Expr * getNilReceiver(const Stmt *S, const ExplodedNode *N)
void Profile(llvm::FoldingSetNodeID &ID) const override
SuppressInlineDefensiveChecksVisitor(DefinedSVal Val, const ExplodedNode *N)
BugReporterVisitors are used to add custom diagnostics along a path.
PathDiagnosticPiece * VisitTerminator(const Stmt *Term, const ExplodedNode *N, const CFGBlock *srcBlk, const CFGBlock *dstBlk, BugReport &R, BugReporterContext &BRC)
static std::unique_ptr< PathDiagnosticPiece > getDefaultEndPath(BugReporterContext &BRC, const ExplodedNode *N, BugReport &BR)
Generates the default final diagnostic piece.
#define false
Definition: stdbool.h:33
void Profile(llvm::FoldingSetNodeID &ID) const override
PathDiagnosticPiece * VisitNode(const ExplodedNode *N, const ExplodedNode *PrevN, BugReporterContext &BRC, BugReport &BR) override
Return a diagnostic piece which should be associated with the given node.
Suppress reports that might lead to known false positives.
PathDiagnosticPiece * VisitNode(const ExplodedNode *N, const ExplodedNode *PrevN, BugReporterContext &BRC, BugReport &BR) override
Return a diagnostic piece which should be associated with the given node.
PathDiagnosticPiece * VisitTrueTest(const Expr *Cond, bool tookTrue, BugReporterContext &BRC, BugReport &R, const ExplodedNode *N)
PathDiagnosticPiece * VisitConditionVariable(StringRef LhsString, const Expr *CondVarExpr, const bool tookTrue, BugReporterContext &BRC, BugReport &R, const ExplodedNode *N)
virtual std::unique_ptr< BugReporterVisitor > clone() const =0
Returns a copy of this BugReporter.
bool isDeclRefExprToReference(const Expr *E)
const Stmt * GetRetValExpr(const ExplodedNode *N)
Represents an SVal that is guaranteed to not be UnknownVal.
Definition: SVals.h:255
PathDiagnosticPiece * VisitNode(const ExplodedNode *Succ, const ExplodedNode *Pred, BugReporterContext &BRC, BugReport &BR) override
Return a diagnostic piece which should be associated with the given node.
bool trackNullOrUndefValue(const ExplodedNode *N, const Stmt *S, BugReport &R, bool IsArg=false, bool EnableNullFPSuppression=true)
PathDiagnosticPiece * VisitNodeImpl(const ExplodedNode *N, const ExplodedNode *Prev, BugReporterContext &BRC, BugReport &BR)
A reference to a declared variable, function, enum, etc. [C99 6.5.1p2].
Definition: Expr.h:899
FindLastStoreBRVisitor(KnownSVal V, const MemRegion *R, bool InEnableNullFPSuppression)