clang  3.7.0
CheckerContext.h
Go to the documentation of this file.
1 //== CheckerContext.h - Context info for path-sensitive checkers--*- C++ -*--=//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This file defines CheckerContext that provides contextual info for
11 // path-sensitive checkers.
12 //
13 //===----------------------------------------------------------------------===//
14 
15 #ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CHECKERCONTEXT_H
16 #define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CHECKERCONTEXT_H
17 
20 
21 namespace clang {
22 namespace ento {
23 
24  /// Declares an immutable map of type \p NameTy, suitable for placement into
25  /// the ProgramState. This is implementing using llvm::ImmutableMap.
26  ///
27  /// \code
28  /// State = State->set<Name>(K, V);
29  /// const Value *V = State->get<Name>(K); // Returns NULL if not in the map.
30  /// State = State->remove<Name>(K);
31  /// NameTy Map = State->get<Name>();
32  /// \endcode
33  ///
34  /// The macro should not be used inside namespaces, or for traits that must
35  /// be accessible from more than one translation unit.
36  #define REGISTER_MAP_WITH_PROGRAMSTATE(Name, Key, Value) \
37  REGISTER_TRAIT_WITH_PROGRAMSTATE(Name, \
38  CLANG_ENTO_PROGRAMSTATE_MAP(Key, Value))
39 
40  /// Declares an immutable set of type \p NameTy, suitable for placement into
41  /// the ProgramState. This is implementing using llvm::ImmutableSet.
42  ///
43  /// \code
44  /// State = State->add<Name>(E);
45  /// State = State->remove<Name>(E);
46  /// bool Present = State->contains<Name>(E);
47  /// NameTy Set = State->get<Name>();
48  /// \endcode
49  ///
50  /// The macro should not be used inside namespaces, or for traits that must
51  /// be accessible from more than one translation unit.
52  #define REGISTER_SET_WITH_PROGRAMSTATE(Name, Elem) \
53  REGISTER_TRAIT_WITH_PROGRAMSTATE(Name, llvm::ImmutableSet<Elem>)
54 
55  /// Declares an immutable list of type \p NameTy, suitable for placement into
56  /// the ProgramState. This is implementing using llvm::ImmutableList.
57  ///
58  /// \code
59  /// State = State->add<Name>(E); // Adds to the /end/ of the list.
60  /// bool Present = State->contains<Name>(E);
61  /// NameTy List = State->get<Name>();
62  /// \endcode
63  ///
64  /// The macro should not be used inside namespaces, or for traits that must
65  /// be accessible from more than one translation unit.
66  #define REGISTER_LIST_WITH_PROGRAMSTATE(Name, Elem) \
67  REGISTER_TRAIT_WITH_PROGRAMSTATE(Name, llvm::ImmutableList<Elem>)
68 
69 
71  ExprEngine &Eng;
72  /// The current exploded(symbolic execution) graph node.
73  ExplodedNode *Pred;
74  /// The flag is true if the (state of the execution) has been modified
75  /// by the checker using this context. For example, a new transition has been
76  /// added or a bug report issued.
77  bool Changed;
78  /// The tagged location, which is used to generate all new nodes.
79  const ProgramPoint Location;
80  NodeBuilder &NB;
81 
82 public:
83  /// If we are post visiting a call, this flag will be set if the
84  /// call was inlined. In all other cases it will be false.
85  const bool wasInlined;
86 
88  ExprEngine &eng,
89  ExplodedNode *pred,
90  const ProgramPoint &loc,
91  bool wasInlined = false)
92  : Eng(eng),
93  Pred(pred),
94  Changed(false),
95  Location(loc),
96  NB(builder),
98  assert(Pred->getState() &&
99  "We should not call the checkers on an empty state.");
100  }
101 
103  return Eng.getAnalysisManager();
104  }
105 
107  return Eng.getConstraintManager();
108  }
109 
111  return Eng.getStoreManager();
112  }
113 
114  /// \brief Returns the previous node in the exploded graph, which includes
115  /// the state of the program before the checker ran. Note, checkers should
116  /// not retain the node in their state since the nodes might get invalidated.
117  ExplodedNode *getPredecessor() { return Pred; }
118  const ProgramStateRef &getState() const { return Pred->getState(); }
119 
120  /// \brief Check if the checker changed the state of the execution; ex: added
121  /// a new transition or a bug report.
122  bool isDifferent() { return Changed; }
123 
124  /// \brief Returns the number of times the current block has been visited
125  /// along the analyzed path.
126  unsigned blockCount() const {
127  return NB.getContext().blockCount();
128  }
129 
131  return Eng.getContext();
132  }
133 
134  const LangOptions &getLangOpts() const {
135  return Eng.getContext().getLangOpts();
136  }
137 
139  return Pred->getLocationContext();
140  }
141 
143  return Pred->getStackFrame();
144  }
145 
146  /// Return true if the current LocationContext has no caller context.
147  bool inTopFrame() const { return getLocationContext()->inTopFrame(); }
148 
150  return Eng.getBugReporter();
151  }
152 
154  return getBugReporter().getSourceManager();
155  }
156 
158  return Eng.getSValBuilder();
159  }
160 
162  return getSValBuilder().getSymbolManager();
163  }
164 
165  bool isObjCGCEnabled() const {
166  return Eng.isObjCGCEnabled();
167  }
168 
170  return Eng.getStateManager();
171  }
172 
174  return Pred->getLocationContext()->getAnalysisDeclContext();
175  }
176 
177  /// \brief Get the blockID.
178  unsigned getBlockID() const {
179  return NB.getContext().getBlock()->getBlockID();
180  }
181 
182  /// \brief If the given node corresponds to a PostStore program point,
183  /// retrieve the location region as it was uttered in the code.
184  ///
185  /// This utility can be useful for generating extensive diagnostics, for
186  /// example, for finding variables that the given symbol was assigned to.
188  ProgramPoint L = N->getLocation();
189  if (Optional<PostStore> PSL = L.getAs<PostStore>())
190  return reinterpret_cast<const MemRegion*>(PSL->getLocationValue());
191  return nullptr;
192  }
193 
194  /// \brief Get the value of arbitrary expressions at this point in the path.
195  SVal getSVal(const Stmt *S) const {
196  return getState()->getSVal(S, getLocationContext());
197  }
198 
199  /// \brief Generates a new transition in the program state graph
200  /// (ExplodedGraph). Uses the default CheckerContext predecessor node.
201  ///
202  /// @param State The state of the generated node. If not specified, the state
203  /// will not be changed, but the new node will have the checker's tag.
204  /// @param Tag The tag is used to uniquely identify the creation site. If no
205  /// tag is specified, a default tag, unique to the given checker,
206  /// will be used. Tags are used to prevent states generated at
207  /// different sites from caching out.
209  const ProgramPointTag *Tag = nullptr) {
210  return addTransitionImpl(State ? State : getState(), false, nullptr, Tag);
211  }
212 
213  /// \brief Generates a new transition with the given predecessor.
214  /// Allows checkers to generate a chain of nodes.
215  ///
216  /// @param State The state of the generated node.
217  /// @param Pred The transition will be generated from the specified Pred node
218  /// to the newly generated node.
219  /// @param Tag The tag to uniquely identify the creation site.
221  ExplodedNode *Pred,
222  const ProgramPointTag *Tag = nullptr) {
223  return addTransitionImpl(State, false, Pred, Tag);
224  }
225 
226  /// \brief Generate a sink node. Generating a sink stops exploration of the
227  /// given path.
229  ExplodedNode *Pred = nullptr,
230  const ProgramPointTag *Tag = nullptr) {
231  return addTransitionImpl(State ? State : getState(), true, Pred, Tag);
232  }
233 
234  /// \brief Emit the diagnostics report.
235  void emitReport(std::unique_ptr<BugReport> R) {
236  Changed = true;
237  Eng.getBugReporter().emitReport(std::move(R));
238  }
239 
240  /// \brief Get the declaration of the called function (path-sensitive).
241  const FunctionDecl *getCalleeDecl(const CallExpr *CE) const;
242 
243  /// \brief Get the name of the called function (path-sensitive).
244  StringRef getCalleeName(const FunctionDecl *FunDecl) const;
245 
246  /// \brief Get the identifier of the called function (path-sensitive).
247  const IdentifierInfo *getCalleeIdentifier(const CallExpr *CE) const {
248  const FunctionDecl *FunDecl = getCalleeDecl(CE);
249  if (FunDecl)
250  return FunDecl->getIdentifier();
251  else
252  return nullptr;
253  }
254 
255  /// \brief Get the name of the called function (path-sensitive).
256  StringRef getCalleeName(const CallExpr *CE) const {
257  const FunctionDecl *FunDecl = getCalleeDecl(CE);
258  return getCalleeName(FunDecl);
259  }
260 
261  /// \brief Returns true if the callee is an externally-visible function in the
262  /// top-level namespace, such as \c malloc.
263  ///
264  /// If a name is provided, the function must additionally match the given
265  /// name.
266  ///
267  /// Note that this deliberately excludes C++ library functions in the \c std
268  /// namespace, but will include C library functions accessed through the
269  /// \c std namespace. This also does not check if the function is declared
270  /// as 'extern "C"', or if it uses C++ name mangling.
271  static bool isCLibraryFunction(const FunctionDecl *FD,
272  StringRef Name = StringRef());
273 
274  /// \brief Depending on wither the location corresponds to a macro, return
275  /// either the macro name or the token spelling.
276  ///
277  /// This could be useful when checkers' logic depends on whether a function
278  /// is called with a given macro argument. For example:
279  /// s = socket(AF_INET,..)
280  /// If AF_INET is a macro, the result should be treated as a source of taint.
281  ///
282  /// \sa clang::Lexer::getSpelling(), clang::Lexer::getImmediateMacroName().
284 
285 private:
286  ExplodedNode *addTransitionImpl(ProgramStateRef State,
287  bool MarkAsSink,
288  ExplodedNode *P = nullptr,
289  const ProgramPointTag *Tag = nullptr) {
290  if (!State || (State == Pred->getState() && !Tag && !MarkAsSink))
291  return Pred;
292 
293  Changed = true;
294  const ProgramPoint &LocalLoc = (Tag ? Location.withTag(Tag) : Location);
295  if (!P)
296  P = Pred;
297 
298  ExplodedNode *node;
299  if (MarkAsSink)
300  node = NB.generateSink(LocalLoc, State, P);
301  else
302  node = NB.generateNode(LocalLoc, State, P);
303  return node;
304  }
305 };
306 
307 } // end GR namespace
308 
309 } // end clang namespace
310 
311 #endif
StringRef getCalleeName(const FunctionDecl *FunDecl) const
Get the name of the called function (path-sensitive).
SymbolManager & getSymbolManager()
Definition: SValBuilder.h:137
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:77
IdentifierInfo * getIdentifier() const
Definition: Decl.h:163
virtual bool inTopFrame() const
Return true if the current LocationContext has no caller context.
ProgramPoint getLocation() const
getLocation - Returns the edge associated with the given node.
ExplodedNode * addTransition(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generates a new transition in the program state graph (ExplodedGraph). Uses the default CheckerContex...
AnalysisManager & getAnalysisManager()
CheckerContext(NodeBuilder &builder, ExprEngine &eng, ExplodedNode *pred, const ProgramPoint &loc, bool wasInlined=false)
ExplodedNode * getPredecessor()
Returns the previous node in the exploded graph, which includes the state of the program before the c...
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:89
const FunctionDecl * getCalleeDecl(const CallExpr *CE) const
Get the declaration of the called function (path-sensitive).
LineState State
Represents a program point after a store evaluation.
Definition: ProgramPoint.h:376
AnalysisDeclContext * getAnalysisDeclContext() const
unsigned blockCount() const
Returns the number of times the current block has been visited along the analyzed path...
ASTContext & getContext() const
getContext - Return the ASTContext associated with this analysis.
Definition: ExprEngine.h:123
Keeps track of the various options that can be enabled, which controls the dialect of C or C++ that i...
Definition: LangOptions.h:48
BugReporter & getBugReporter()
const IdentifierInfo * getCalleeIdentifier(const CallExpr *CE) const
Get the identifier of the called function (path-sensitive).
const LangOptions & getLangOpts() const
Definition: ASTContext.h:533
ProgramStateManager & getStateManager()
const LocationContext * getLocationContext() const
AnnotatingParser & P
ExplodedNode * generateSink(ProgramStateRef State=nullptr, ExplodedNode *Pred=nullptr, const ProgramPointTag *Tag=nullptr)
Generate a sink node. Generating a sink stops exploration of the given path.
unsigned blockCount() const
Returns the number of times the current basic block has been visited on the exploded graph path...
Definition: CoreEngine.h:191
bool inTopFrame() const
Return true if the current LocationContext has no caller context.
ExplodedNode * generateSink(const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred)
Generates a sink in the ExplodedGraph.
Definition: CoreEngine.h:271
const ProgramStateRef & getState() const
const ProgramStateRef & getState() const
static bool isCLibraryFunction(const FunctionDecl *FD, StringRef Name=StringRef())
Returns true if the callee is an externally-visible function in the top-level namespace, such as malloc.
This is the simplest builder which generates nodes in the ExplodedGraph.
Definition: CoreEngine.h:207
ExplodedNode * addTransition(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
Generates a new transition with the given predecessor. Allows checkers to generate a chain of nodes...
SymbolManager & getSymbolManager()
unsigned getBlockID() const
Definition: CFG.h:639
ConstraintManager & getConstraintManager()
void emitReport(std::unique_ptr< BugReport > R)
Emit the diagnostics report.
#define false
Definition: stdbool.h:33
StoreManager & getStoreManager()
Encodes a location in the source. The SourceManager can decode this to get at the full include stack...
AnalysisManager & getAnalysisManager() override
Definition: ExprEngine.h:125
void emitReport(std::unique_ptr< BugReport > R)
Add the given report to the set of reports tracked by BugReporter.
ProgramPoint withTag(const ProgramPointTag *tag) const
Definition: ProgramPoint.h:108
BugReporter & getBugReporter()
Definition: ExprEngine.h:133
const StackFrameContext * getStackFrame() const
SValBuilder & getSValBuilder()
Definition: ExprEngine.h:131
StoreManager & getStoreManager()
Definition: ExprEngine.h:300
const NodeBuilderContext & getContext()
Definition: CoreEngine.h:295
StringRef getMacroNameOrSpelling(SourceLocation &Loc)
Depending on wither the location corresponds to a macro, return either the macro name or the token sp...
StringRef getCalleeName(const CallExpr *CE) const
Get the name of the called function (path-sensitive).
Optional< T > getAs() const
Convert to the specified ProgramPoint type, returning None if this ProgramPoint is not of the desired...
Definition: ProgramPoint.h:127
ProgramStateManager & getStateManager() override
Definition: ExprEngine.h:298
const CFGBlock * getBlock() const
Return the CFGBlock associated with this builder.
Definition: CoreEngine.h:187
const LangOptions & getLangOpts() const
const StackFrameContext * getStackFrame() const
ExplodedNode * generateNode(const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred)
Generates a node in the ExplodedGraph.
Definition: CoreEngine.h:260
SourceManager & getSourceManager()
Definition: BugReporter.h:448
AnalysisDeclContext * getCurrentAnalysisDeclContext() const
unsigned getBlockID() const
Get the blockID.
SourceManager & getSourceManager()
SValBuilder & getSValBuilder()
static const MemRegion * getLocationRegionIfPostStore(const ExplodedNode *N)
If the given node corresponds to a PostStore program point, retrieve the location region as it was ut...
ConstraintManager & getConstraintManager()
Definition: ExprEngine.h:302
bool isDifferent()
Check if the checker changed the state of the execution; ex: added a new transition or a bug report...
This class handles loading and caching of source files into memory.
const LocationContext * getLocationContext() const
SVal getSVal(const Stmt *S) const
Get the value of arbitrary expressions at this point in the path.