Public Member Functions | |
| void | checkPreStmt (const DeclStmt *DS, CheckerContext &C) const |
| Pre-visit the Statement. | |
| void | checkPostStmt (const CallExpr *DS, CheckerContext &C) const |
| Post-visit the Statement. | |
| void | checkPreObjCMessage (const ObjCMessage &Msg, CheckerContext &C) const |
| Pre-visit the Objective C messages. | |
| void | checkPostObjCMessage (const ObjCMessage &Msg, CheckerContext &C) const |
| Post-visit the Objective C messages. | |
| void | checkBranchCondition (const Stmt *Condition, CheckerContext &Ctx) const |
| Pre-visit of the condition statement of a branch (such as IfStmt). | |
| void | checkLocation (SVal Loc, bool IsLoad, const Stmt *S, CheckerContext &C) const |
| Called on a load from and a store to a location. | |
| void | checkBind (SVal Loc, SVal Val, const Stmt *S, CheckerContext &C) const |
| Called on binding of a value to a location. | |
| void | checkDeadSymbols (SymbolReaper &SR, CheckerContext &C) const |
| Called whenever a symbol becomes dead. | |
| void | checkEndPath (CheckerContext &Ctx) const |
| Called when an end of path is reached in the ExplodedGraph. | |
| void | checkEndAnalysis (ExplodedGraph &G, BugReporter &BR, ExprEngine &Eng) const |
| Called after all the paths in the ExplodedGraph reach end of path. | |
| void | checkEndOfTranslationUnit (const TranslationUnitDecl *TU, AnalysisManager &Mgr, BugReporter &BR) const |
| Called after analysis of a TranslationUnit is complete. | |
| bool | evalCall (const CallExpr *CE, CheckerContext &C) const |
| Evaluates function call. | |
| ProgramStateRef | evalAssume (ProgramStateRef State, SVal Cond, bool Assumption) const |
| Handles assumptions on symbolic values. | |
| void | checkLiveSymbols (ProgramStateRef State, SymbolReaper &SR) const |
| bool | wantsRegionChangeUpdate (ProgramStateRef St) const |
| True if at least one checker wants to check region changes. | |
| ProgramStateRef | checkRegionChanges (ProgramStateRef State, const StoreManager::InvalidatedSymbols *, ArrayRef< const MemRegion * > ExplicitRegions, ArrayRef< const MemRegion * > Regions, const CallOrObjCMessage *Call) const |
| void | checkEvent (ImplicitNullDerefEvent Event) const |
| check::Event<ImplicitNullDerefEvent> | |
| void | checkASTDecl (const FunctionDecl *D, AnalysisManager &Mgr, BugReporter &BR) const |
| Check every declaration in the AST. | |
Detailed Description
This checker documents the callback functions checkers can use to implement the custom handling of the specific events during path exploration as well as reporting bugs. Most of the callbacks are targeted at path-sensitive checking.
- See also:
- CheckerContext
Definition at line 36 of file CheckerDocumentation.cpp.
Member Function Documentation
| void ento::CheckerDocumentation::checkASTDecl | ( | const FunctionDecl * | D, |
| AnalysisManager & | Mgr, | ||
| BugReporter & | BR | ||
| ) | const [inline] |
Check every declaration in the AST.
An AST traversal callback, which should only be used when the checker is not path sensitive. It will be called for every Declaration in the AST and can be specialized to only be called on subclasses of Decl, for example, FunctionDecl.
check::ASTDecl<FunctionDecl>
Definition at line 222 of file CheckerDocumentation.cpp.
| void ento::CheckerDocumentation::checkBind | ( | SVal | Loc, |
| SVal | Val, | ||
| const Stmt * | S, | ||
| CheckerContext & | C | ||
| ) | const [inline] |
Called on binding of a value to a location.
- Parameters:
-
Loc The value of the location (pointer). Val The value which will be stored at the location Loc. S The bind is performed while processing the statement S.
check::Bind
Definition at line 106 of file CheckerDocumentation.cpp.
| void ento::CheckerDocumentation::checkBranchCondition | ( | const Stmt * | Condition, |
| CheckerContext & | Ctx | ||
| ) | const [inline] |
Pre-visit of the condition statement of a branch (such as IfStmt).
Definition at line 85 of file CheckerDocumentation.cpp.
| void ento::CheckerDocumentation::checkDeadSymbols | ( | SymbolReaper & | SR, |
| CheckerContext & | C | ||
| ) | const [inline] |
Called whenever a symbol becomes dead.
This callback should be used by the checkers to aggressively clean up/reduce the checker state, which is important for reducing the overall memory usage. Specifically, if a checker keeps symbol specific information in the sate, it can and should be dropped after the symbol becomes dead. In addition, reporting a bug as soon as the checker becomes dead leads to more precise diagnostics. (For example, one should report that a malloced variable is not freed right after it goes out of scope.)
- Parameters:
-
SR The SymbolReaper object can be queried to determine which symbols are dead.
check::DeadSymbols
Definition at line 123 of file CheckerDocumentation.cpp.
| void ento::CheckerDocumentation::checkEndAnalysis | ( | ExplodedGraph & | G, |
| BugReporter & | BR, | ||
| ExprEngine & | Eng | ||
| ) | const [inline] |
Called after all the paths in the ExplodedGraph reach end of path.
- the symbolic execution graph is fully explored.
This callback should be used in cases when a checker needs to have a global view of the information generated on all paths. For example, to compare execution summary/result several paths. See IdempotentOperationChecker for a usage example.
check::EndAnalysis
Definition at line 141 of file CheckerDocumentation.cpp.
| void ento::CheckerDocumentation::checkEndOfTranslationUnit | ( | const TranslationUnitDecl * | TU, |
| AnalysisManager & | Mgr, | ||
| BugReporter & | BR | ||
| ) | const [inline] |
Called after analysis of a TranslationUnit is complete.
check::EndOfTranslationUnit
Definition at line 148 of file CheckerDocumentation.cpp.
| void ento::CheckerDocumentation::checkEndPath | ( | CheckerContext & | Ctx | ) | const [inline] |
Called when an end of path is reached in the ExplodedGraph.
This callback should be used to check if the allocated resources are freed.
check::EndPath
Definition at line 130 of file CheckerDocumentation.cpp.
| void ento::CheckerDocumentation::checkEvent | ( | ImplicitNullDerefEvent | Event | ) | const [inline] |
check::Event<ImplicitNullDerefEvent>
Definition at line 212 of file CheckerDocumentation.cpp.
| void ento::CheckerDocumentation::checkLiveSymbols | ( | ProgramStateRef | State, |
| SymbolReaper & | SR | ||
| ) | const [inline] |
Allows modifying SymbolReaper object. For example, checkers can explicitly register symbols of interest as live. These symbols will not be marked dead and removed.
check::LiveSymbols
Definition at line 185 of file CheckerDocumentation.cpp.
| void ento::CheckerDocumentation::checkLocation | ( | SVal | Loc, |
| bool | IsLoad, | ||
| const Stmt * | S, | ||
| CheckerContext & | C | ||
| ) | const [inline] |
Called on a load from and a store to a location.
The method will be called each time a location (pointer) value is accessed.
- Parameters:
-
Loc The value of the location (pointer). IsLoad The flag specifying if the location is a store or a load. S The load is performed while processing the statement.
check::Location
Definition at line 96 of file CheckerDocumentation.cpp.
| void ento::CheckerDocumentation::checkPostObjCMessage | ( | const ObjCMessage & | Msg, |
| CheckerContext & | C | ||
| ) | const [inline] |
Post-visit the Objective C messages.
Definition at line 82 of file CheckerDocumentation.cpp.
| void ento::CheckerDocumentation::checkPostStmt | ( | const CallExpr * | DS, |
| CheckerContext & | C | ||
| ) | const |
Post-visit the Statement.
The method will be called after the analyzer core processes the statement. The notification is performed for every explored CFGElement, which does not include the control flow statements such as IfStmt. The callback can be specialized to be called with any subclass of Stmt.
check::PostStmt<DeclStmt>
Definition at line 228 of file CheckerDocumentation.cpp.
| void ento::CheckerDocumentation::checkPreObjCMessage | ( | const ObjCMessage & | Msg, |
| CheckerContext & | C | ||
| ) | const [inline] |
Pre-visit the Objective C messages.
Definition at line 79 of file CheckerDocumentation.cpp.
| void ento::CheckerDocumentation::checkPreStmt | ( | const DeclStmt * | DS, |
| CheckerContext & | C | ||
| ) | const [inline] |
Pre-visit the Statement.
The method will be called before the analyzer core processes the statement. The notification is performed for every explored CFGElement, which does not include the control flow statements such as IfStmt. The callback can be specialized to be called with any subclass of Stmt.
See checkBranchCondition() callback for performing custom processing of the branching statements.
check::PreStmt<DeclStmt>
Definition at line 66 of file CheckerDocumentation.cpp.
| ProgramStateRef ento::CheckerDocumentation::checkRegionChanges | ( | ProgramStateRef | State, |
| const StoreManager::InvalidatedSymbols * | , | ||
| ArrayRef< const MemRegion * > | ExplicitRegions, | ||
| ArrayRef< const MemRegion * > | Regions, | ||
| const CallOrObjCMessage * | Call | ||
| ) | const [inline] |
check::RegionChanges Allows tracking regions which get invalidated.
- Parameters:
-
state The current program state. invalidated A set of all symbols potentially touched by the change. ExplicitRegions The regions explicitly requested for invalidation. For example, in the case of a function call, these would be arguments. Regions The transitive closure of accessible regions, i.e. all regions that may have been touched by this change. The call expression wrapper if the regions are invalidated by a call, 0 otherwise. Note, in order to be notified, the checker should also implement wantsRegionChangeUpdate callback.
Definition at line 203 of file CheckerDocumentation.cpp.
| ProgramStateRef ento::CheckerDocumentation::evalAssume | ( | ProgramStateRef | State, |
| SVal | Cond, | ||
| bool | Assumption | ||
| ) | const [inline] |
Handles assumptions on symbolic values.
This method is called when a symbolic expression is assumed to be true or false. For example, the assumptions are performed when evaluating a condition at a branch. The callback allows checkers track the assumptions performed on the symbols of interest and change the state accordingly.
eval::Assume
Definition at line 176 of file CheckerDocumentation.cpp.
| bool ento::CheckerDocumentation::evalCall | ( | const CallExpr * | CE, |
| CheckerContext & | C | ||
| ) | const [inline] |
Evaluates function call.
The analysis core threats all function calls in the same way. However, some functions have special meaning, which should be reflected in the program state. This callback allows a checker to provide domain specific knowledge about the particular functions it knows about.
- Returns:
- true if the call has been successfully evaluated and false otherwise. Note, that only one checker can evaluate a call. If more then one checker claim that they can evaluate the same call the first one wins.
eval::Call
Definition at line 166 of file CheckerDocumentation.cpp.
| bool ExprEngine::wantsRegionChangeUpdate | ( | ProgramStateRef | St | ) | const [inline] |
True if at least one checker wants to check region changes.
Definition at line 188 of file CheckerDocumentation.cpp.
The documentation for this class was generated from the following files: