clang  6.0.0svn
BuiltinFunctionChecker.cpp
Go to the documentation of this file.
1 //=== BuiltinFunctionChecker.cpp --------------------------------*- C++ -*-===//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This checker evaluates clang builtin functions.
11 //
12 //===----------------------------------------------------------------------===//
13 
14 #include "ClangSACheckers.h"
15 #include "clang/Basic/Builtins.h"
19 
20 using namespace clang;
21 using namespace ento;
22 
23 namespace {
24 
25 class BuiltinFunctionChecker : public Checker<eval::Call> {
26 public:
27  bool evalCall(const CallExpr *CE, CheckerContext &C) const;
28 };
29 
30 }
31 
32 bool BuiltinFunctionChecker::evalCall(const CallExpr *CE,
33  CheckerContext &C) const {
35  const FunctionDecl *FD = C.getCalleeDecl(CE);
36  const LocationContext *LCtx = C.getLocationContext();
37  if (!FD)
38  return false;
39 
40  switch (FD->getBuiltinID()) {
41  default:
42  return false;
43 
44  case Builtin::BI__builtin_assume: {
45  assert (CE->arg_begin() != CE->arg_end());
46  SVal ArgSVal = state->getSVal(CE->getArg(0), LCtx);
47  if (ArgSVal.isUndef())
48  return true; // Return true to model purity.
49 
50  state = state->assume(ArgSVal.castAs<DefinedOrUnknownSVal>(), true);
51  // FIXME: do we want to warn here? Not right now. The most reports might
52  // come from infeasible paths, thus being false positives.
53  if (!state) {
55  return true;
56  }
57 
58  C.addTransition(state);
59  return true;
60  }
61 
62  case Builtin::BI__builtin_unpredictable:
63  case Builtin::BI__builtin_expect:
64  case Builtin::BI__builtin_assume_aligned:
65  case Builtin::BI__builtin_addressof: {
66  // For __builtin_unpredictable, __builtin_expect, and
67  // __builtin_assume_aligned, just return the value of the subexpression.
68  // __builtin_addressof is going from a reference to a pointer, but those
69  // are represented the same way in the analyzer.
70  assert (CE->arg_begin() != CE->arg_end());
71  SVal X = state->getSVal(*(CE->arg_begin()), LCtx);
72  C.addTransition(state->BindExpr(CE, LCtx, X));
73  return true;
74  }
75 
76  case Builtin::BI__builtin_alloca_with_align:
77  case Builtin::BI__builtin_alloca: {
78  // FIXME: Refactor into StoreManager itself?
80  const AllocaRegion* R =
82 
83  // Set the extent of the region in bytes. This enables us to use the
84  // SVal of the argument directly. If we save the extent in bits, we
85  // cannot represent values like symbol*8.
87  state->getSVal(*(CE->arg_begin()), LCtx).castAs<DefinedOrUnknownSVal>();
88 
89  SValBuilder& svalBuilder = C.getSValBuilder();
90  DefinedOrUnknownSVal Extent = R->getExtent(svalBuilder);
91  DefinedOrUnknownSVal extentMatchesSizeArg =
92  svalBuilder.evalEQ(state, Extent, Size);
93  state = state->assume(extentMatchesSizeArg, true);
94  assert(state && "The region should not have any previous constraints");
95 
96  C.addTransition(state->BindExpr(CE, LCtx, loc::MemRegionVal(R)));
97  return true;
98  }
99 
100  case Builtin::BI__builtin_object_size: {
101  // This must be resolvable at compile time, so we defer to the constant
102  // evaluator for a value.
103  SVal V = UnknownVal();
104  llvm::APSInt Result;
105  if (CE->EvaluateAsInt(Result, C.getASTContext(), Expr::SE_NoSideEffects)) {
106  // Make sure the result has the correct type.
107  SValBuilder &SVB = C.getSValBuilder();
109  BVF.getAPSIntType(CE->getType()).apply(Result);
110  V = SVB.makeIntVal(Result);
111  }
112 
113  C.addTransition(state->BindExpr(CE, LCtx, V));
114  return true;
115  }
116  }
117 }
118 
119 void ento::registerBuiltinFunctionChecker(CheckerManager &mgr) {
120  mgr.registerChecker<BuiltinFunctionChecker>();
121 }
FunctionDecl - An instance of this class is created to represent a function declaration or definition...
Definition: Decl.h:1698
nonloc::ConcreteInt makeIntVal(const IntegerLiteral *integer)
Definition: SValBuilder.h:254
Expr * getArg(unsigned Arg)
getArg - Return the specified argument.
Definition: Expr.h:2278
ExplodedNode * addTransition(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generates a new transition in the program state graph (ExplodedGraph).
Strictly evaluate the expression.
Definition: Expr.h:595
AllocaRegion - A region that represents an untyped blob of bytes created by a call to &#39;alloca&#39;...
Definition: MemRegion.h:454
bool EvaluateAsInt(llvm::APSInt &Result, const ASTContext &Ctx, SideEffectsKind AllowSideEffects=SE_NoSideEffects) const
EvaluateAsInt - Return true if this is a constant which we can fold and convert to an integer...
const FunctionDecl * getCalleeDecl(const CallExpr *CE) const
Get the declaration of the called function (path-sensitive).
ExplodedNode * getPredecessor()
Returns the previous node in the exploded graph, which includes the state of the program before the c...
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
const AllocaRegion * getAllocaRegion(const Expr *Ex, unsigned Cnt, const LocationContext *LC)
getAllocaRegion - Retrieve a region associated with a call to alloca().
Definition: MemRegion.cpp:1054
arg_iterator arg_end()
Definition: Expr.h:2309
DefinedOrUnknownSVal getExtent(SValBuilder &svalBuilder) const override
getExtent - Returns the size of the region in bytes.
Definition: MemRegion.cpp:172
QualType getType() const
Definition: Expr.h:128
CHECKER * registerChecker()
Used to register checkers.
StoreManager & getStoreManager()
ExplodedNode * generateSink(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
Generate a sink node.
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
Definition: SVals.h:63
unsigned blockCount() const
Returns the number of times the current block has been visited along the analyzed path...
Dataflow Directional Tag Classes.
APSIntType getAPSIntType(QualType T) const
Returns the type of the APSInt used to store values of the given QualType.
MemRegionManager & getRegionManager()
getRegionManager - Returns the internal RegionManager object that is used to query and manipulate Mem...
Definition: Store.h:108
BasicValueFactory & getBasicValueFactory()
Definition: SValBuilder.h:144
const ProgramStateRef & getState() const
arg_iterator arg_begin()
Definition: Expr.h:2308
X
Add a minimal nested name specifier fixit hint to allow lookup of a tag name from an outer enclosing ...
Definition: SemaDecl.cpp:13010
unsigned getBuiltinID() const
Returns a value indicating whether this function corresponds to a builtin function.
Definition: Decl.cpp:2852
SValBuilder & getSValBuilder()
CallExpr - Represents a function call (C99 6.5.2.2, C++ [expr.call]).
Definition: Expr.h:2209
const LocationContext * getLocationContext() const
Defines enum values for all the target-independent builtin functions.