clang  8.0.0svn
BugReporterVisitors.h
Go to the documentation of this file.
1 //===- BugReporterVisitors.h - Generate PathDiagnostics ---------*- C++ -*-===//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This file declares BugReporterVisitors, which are used to generate enhanced
11 // diagnostic traces.
12 //
13 //===----------------------------------------------------------------------===//
14 
15 #ifndef LLVM_CLANG_STATICANALYZER_CORE_BUGREPORTER_BUGREPORTERVISITORS_H
16 #define LLVM_CLANG_STATICANALYZER_CORE_BUGREPORTER_BUGREPORTERVISITORS_H
17 
18 #include "clang/Basic/LLVM.h"
21 #include "llvm/ADT/FoldingSet.h"
22 #include "llvm/ADT/STLExtras.h"
23 #include "llvm/ADT/StringRef.h"
24 #include <memory>
25 
26 namespace clang {
27 
28 class BinaryOperator;
29 class CFGBlock;
30 class DeclRefExpr;
31 class Expr;
32 class Stmt;
33 
34 namespace ento {
35 
36 class BugReport;
37 class BugReporterContext;
38 class ExplodedNode;
39 class MemRegion;
40 class PathDiagnosticPiece;
41 
42 /// BugReporterVisitors are used to add custom diagnostics along a path.
43 class BugReporterVisitor : public llvm::FoldingSetNode {
44 public:
45  BugReporterVisitor() = default;
46  BugReporterVisitor(const BugReporterVisitor &) = default;
48  virtual ~BugReporterVisitor();
49 
50  /// Return a diagnostic piece which should be associated with the
51  /// given node.
52  /// Note that this function does *not* get run on the very last node
53  /// of the report, as the PathDiagnosticPiece associated with the
54  /// last node should be unique.
55  /// Use {@code getEndPath} to customize the note associated with the report
56  /// end instead.
57  ///
58  /// The last parameter can be used to register a new visitor with the given
59  /// BugReport while processing a node.
60  virtual std::shared_ptr<PathDiagnosticPiece>
61  VisitNode(const ExplodedNode *Succ, const ExplodedNode *Pred,
62  BugReporterContext &BRC, BugReport &BR) = 0;
63 
64  /// Last function called on the visitor, no further calls to VisitNode
65  /// would follow.
66  virtual void finalizeVisitor(BugReporterContext &BRC,
67  const ExplodedNode *EndPathNode,
68  BugReport &BR);
69 
70  /// Provide custom definition for the final diagnostic piece on the
71  /// path - the piece, which is displayed before the path is expanded.
72  ///
73  /// NOTE that this function can be implemented on at most one used visitor,
74  /// and otherwise it crahes at runtime.
75  virtual std::shared_ptr<PathDiagnosticPiece>
76  getEndPath(BugReporterContext &BRC, const ExplodedNode *N, BugReport &BR);
77 
78  virtual void Profile(llvm::FoldingSetNodeID &ID) const = 0;
79 
80  /// Generates the default final diagnostic piece.
81  static std::shared_ptr<PathDiagnosticPiece>
82  getDefaultEndPath(BugReporterContext &BRC, const ExplodedNode *N,
83  BugReport &BR);
84 };
85 
86 /// Finds last store into the given region,
87 /// which is different from a given symbolic value.
88 class FindLastStoreBRVisitor final : public BugReporterVisitor {
89  const MemRegion *R;
90  SVal V;
91  bool Satisfied = false;
92 
93  /// If the visitor is tracking the value directly responsible for the
94  /// bug, we are going to employ false positive suppression.
95  bool EnableNullFPSuppression;
96 
97 public:
98  /// Creates a visitor for every VarDecl inside a Stmt and registers it with
99  /// the BugReport.
100  static void registerStatementVarDecls(BugReport &BR, const Stmt *S,
101  bool EnableNullFPSuppression);
102 
103  FindLastStoreBRVisitor(KnownSVal V, const MemRegion *R,
104  bool InEnableNullFPSuppression)
105  : R(R), V(V), EnableNullFPSuppression(InEnableNullFPSuppression) {}
106 
107  void Profile(llvm::FoldingSetNodeID &ID) const override;
108 
109  std::shared_ptr<PathDiagnosticPiece> VisitNode(const ExplodedNode *N,
110  const ExplodedNode *PrevN,
111  BugReporterContext &BRC,
112  BugReport &BR) override;
113 };
114 
115 class TrackConstraintBRVisitor final : public BugReporterVisitor {
116  DefinedSVal Constraint;
117  bool Assumption;
118  bool IsSatisfied = false;
119  bool IsZeroCheck;
120 
121  /// We should start tracking from the last node along the path in which the
122  /// value is constrained.
123  bool IsTrackingTurnedOn = false;
124 
125 public:
126  TrackConstraintBRVisitor(DefinedSVal constraint, bool assumption)
127  : Constraint(constraint), Assumption(assumption),
128  IsZeroCheck(!Assumption && Constraint.getAs<Loc>()) {}
129 
130  void Profile(llvm::FoldingSetNodeID &ID) const override;
131 
132  /// Return the tag associated with this visitor. This tag will be used
133  /// to make all PathDiagnosticPieces created by this visitor.
134  static const char *getTag();
135 
136  std::shared_ptr<PathDiagnosticPiece> VisitNode(const ExplodedNode *N,
137  const ExplodedNode *PrevN,
138  BugReporterContext &BRC,
139  BugReport &BR) override;
140 
141 private:
142  /// Checks if the constraint is valid in the current state.
143  bool isUnderconstrained(const ExplodedNode *N) const;
144 };
145 
146 /// \class NilReceiverBRVisitor
147 /// Prints path notes when a message is sent to a nil receiver.
148 class NilReceiverBRVisitor final : public BugReporterVisitor {
149 public:
150  void Profile(llvm::FoldingSetNodeID &ID) const override {
151  static int x = 0;
152  ID.AddPointer(&x);
153  }
154 
155  std::shared_ptr<PathDiagnosticPiece> VisitNode(const ExplodedNode *N,
156  const ExplodedNode *PrevN,
157  BugReporterContext &BRC,
158  BugReport &BR) override;
159 
160  /// If the statement is a message send expression with nil receiver, returns
161  /// the receiver expression. Returns NULL otherwise.
162  static const Expr *getNilReceiver(const Stmt *S, const ExplodedNode *N);
163 };
164 
165 /// Visitor that tries to report interesting diagnostics from conditions.
166 class ConditionBRVisitor final : public BugReporterVisitor {
167  // FIXME: constexpr initialization isn't supported by MSVC2013.
168  static const char *const GenericTrueMessage;
169  static const char *const GenericFalseMessage;
170 
171 public:
172  void Profile(llvm::FoldingSetNodeID &ID) const override {
173  static int x = 0;
174  ID.AddPointer(&x);
175  }
176 
177  /// Return the tag associated with this visitor. This tag will be used
178  /// to make all PathDiagnosticPieces created by this visitor.
179  static const char *getTag();
180 
181  std::shared_ptr<PathDiagnosticPiece> VisitNode(const ExplodedNode *N,
182  const ExplodedNode *Prev,
183  BugReporterContext &BRC,
184  BugReport &BR) override;
185 
186  std::shared_ptr<PathDiagnosticPiece> VisitNodeImpl(const ExplodedNode *N,
187  const ExplodedNode *Prev,
188  BugReporterContext &BRC,
189  BugReport &BR);
190 
191  std::shared_ptr<PathDiagnosticPiece>
192  VisitTerminator(const Stmt *Term, const ExplodedNode *N,
193  const CFGBlock *srcBlk, const CFGBlock *dstBlk, BugReport &R,
194  BugReporterContext &BRC);
195 
196  std::shared_ptr<PathDiagnosticPiece>
197  VisitTrueTest(const Expr *Cond, bool tookTrue, BugReporterContext &BRC,
198  BugReport &R, const ExplodedNode *N);
199 
200  std::shared_ptr<PathDiagnosticPiece>
201  VisitTrueTest(const Expr *Cond, const DeclRefExpr *DR, const bool tookTrue,
202  BugReporterContext &BRC, BugReport &R, const ExplodedNode *N);
203 
204  std::shared_ptr<PathDiagnosticPiece>
205  VisitTrueTest(const Expr *Cond, const BinaryOperator *BExpr,
206  const bool tookTrue, BugReporterContext &BRC, BugReport &R,
207  const ExplodedNode *N);
208 
209  std::shared_ptr<PathDiagnosticPiece>
210  VisitConditionVariable(StringRef LhsString, const Expr *CondVarExpr,
211  const bool tookTrue, BugReporterContext &BRC,
212  BugReport &R, const ExplodedNode *N);
213 
214  bool patternMatch(const Expr *Ex,
215  const Expr *ParentEx,
216  raw_ostream &Out,
217  BugReporterContext &BRC,
218  BugReport &R,
219  const ExplodedNode *N,
220  Optional<bool> &prunable);
221 
222  static bool isPieceMessageGeneric(const PathDiagnosticPiece *Piece);
223 };
224 
225 /// Suppress reports that might lead to known false positives.
226 ///
227 /// Currently this suppresses reports based on locations of bugs.
228 class LikelyFalsePositiveSuppressionBRVisitor final
229  : public BugReporterVisitor {
230 public:
231  static void *getTag() {
232  static int Tag = 0;
233  return static_cast<void *>(&Tag);
234  }
235 
236  void Profile(llvm::FoldingSetNodeID &ID) const override {
237  ID.AddPointer(getTag());
238  }
239 
240  std::shared_ptr<PathDiagnosticPiece> VisitNode(const ExplodedNode *N,
241  const ExplodedNode *Prev,
242  BugReporterContext &BRC,
243  BugReport &BR) override {
244  return nullptr;
245  }
246 
247  void finalizeVisitor(BugReporterContext &BRC, const ExplodedNode *N,
248  BugReport &BR) override;
249 };
250 
251 /// When a region containing undefined value or '0' value is passed
252 /// as an argument in a call, marks the call as interesting.
253 ///
254 /// As a result, BugReporter will not prune the path through the function even
255 /// if the region's contents are not modified/accessed by the call.
256 class UndefOrNullArgVisitor final : public BugReporterVisitor {
257  /// The interesting memory region this visitor is tracking.
258  const MemRegion *R;
259 
260 public:
261  UndefOrNullArgVisitor(const MemRegion *InR) : R(InR) {}
262 
263  void Profile(llvm::FoldingSetNodeID &ID) const override {
264  static int Tag = 0;
265  ID.AddPointer(&Tag);
266  ID.AddPointer(R);
267  }
268 
269  std::shared_ptr<PathDiagnosticPiece> VisitNode(const ExplodedNode *N,
270  const ExplodedNode *PrevN,
271  BugReporterContext &BRC,
272  BugReport &BR) override;
273 };
274 
275 class SuppressInlineDefensiveChecksVisitor final : public BugReporterVisitor {
276  /// The symbolic value for which we are tracking constraints.
277  /// This value is constrained to null in the end of path.
278  DefinedSVal V;
279 
280  /// Track if we found the node where the constraint was first added.
281  bool IsSatisfied = false;
282 
283  /// Since the visitors can be registered on nodes previous to the last
284  /// node in the BugReport, but the path traversal always starts with the last
285  /// node, the visitor invariant (that we start with a node in which V is null)
286  /// might not hold when node visitation starts. We are going to start tracking
287  /// from the last node in which the value is null.
288  bool IsTrackingTurnedOn = false;
289 
290 public:
291  SuppressInlineDefensiveChecksVisitor(DefinedSVal Val, const ExplodedNode *N);
292 
293  void Profile(llvm::FoldingSetNodeID &ID) const override;
294 
295  /// Return the tag associated with this visitor. This tag will be used
296  /// to make all PathDiagnosticPieces created by this visitor.
297  static const char *getTag();
298 
299  std::shared_ptr<PathDiagnosticPiece> VisitNode(const ExplodedNode *Succ,
300  const ExplodedNode *Pred,
301  BugReporterContext &BRC,
302  BugReport &BR) override;
303 };
304 
305 class CXXSelfAssignmentBRVisitor final : public BugReporterVisitor {
306  bool Satisfied = false;
307 
308 public:
309  CXXSelfAssignmentBRVisitor() = default;
310 
311  void Profile(llvm::FoldingSetNodeID &ID) const override {}
312 
313  std::shared_ptr<PathDiagnosticPiece> VisitNode(const ExplodedNode *Succ,
314  const ExplodedNode *Pred,
315  BugReporterContext &BRC,
316  BugReport &BR) override;
317 };
318 
319 /// The bug visitor prints a diagnostic message at the location where a given
320 /// variable was tainted.
321 class TaintBugVisitor final : public BugReporterVisitor {
322 private:
323  const SVal V;
324 
325 public:
326  TaintBugVisitor(const SVal V) : V(V) {}
327  void Profile(llvm::FoldingSetNodeID &ID) const override { ID.Add(V); }
328 
329  std::shared_ptr<PathDiagnosticPiece> VisitNode(const ExplodedNode *N,
330  const ExplodedNode *PrevN,
331  BugReporterContext &BRC,
332  BugReport &BR) override;
333 };
334 
335 /// The bug visitor will walk all the nodes in a path and collect all the
336 /// constraints. When it reaches the root node, will create a refutation
337 /// manager and check if the constraints are satisfiable
338 class FalsePositiveRefutationBRVisitor final : public BugReporterVisitor {
339 private:
340  /// Holds the constraints in a given path
341  ConstraintRangeTy Constraints;
342 
343 public:
344  FalsePositiveRefutationBRVisitor();
345 
346  void Profile(llvm::FoldingSetNodeID &ID) const override;
347 
348  std::shared_ptr<PathDiagnosticPiece> VisitNode(const ExplodedNode *N,
349  const ExplodedNode *PrevN,
350  BugReporterContext &BRC,
351  BugReport &BR) override;
352 
353  void finalizeVisitor(BugReporterContext &BRC, const ExplodedNode *EndPathNode,
354  BugReport &BR) override;
355 };
356 
357 namespace bugreporter {
358 
359 /// Attempts to add visitors to trace a null or undefined value back to its
360 /// point of origin, whether it is a symbol constrained to null or an explicit
361 /// assignment.
362 ///
363 /// \param N A node "downstream" from the evaluation of the statement.
364 /// \param S The statement whose value is null or undefined.
365 /// \param R The bug report to which visitors should be attached.
366 /// \param IsArg Whether the statement is an argument to an inlined function.
367 /// If this is the case, \p N \em must be the CallEnter node for
368 /// the function.
369 /// \param EnableNullFPSuppression Whether we should employ false positive
370 /// suppression (inlined defensive checks, returned null).
371 ///
372 /// \return Whether or not the function was able to add visitors for this
373 /// statement. Note that returning \c true does not actually imply
374 /// that any visitors were added.
375 bool trackNullOrUndefValue(const ExplodedNode *N, const Stmt *S, BugReport &R,
376  bool IsArg = false,
377  bool EnableNullFPSuppression = true);
378 
379 const Expr *getDerefExpr(const Stmt *S);
380 const Stmt *GetDenomExpr(const ExplodedNode *N);
381 const Stmt *GetRetValExpr(const ExplodedNode *N);
382 bool isDeclRefExprToReference(const Expr *E);
383 
384 } // namespace bugreporter
385 
386 } // namespace ento
387 
388 } // namespace clang
389 
390 #endif // LLVM_CLANG_STATICANALYZER_CORE_BUGREPORTER_BUGREPORTERVISITORS_H
llvm::ImmutableMap< SymbolRef, RangeSet > ConstraintRangeTy
Forward-declares and imports various common LLVM datatypes that clang wants to use unqualified...
Dataflow Directional Tag Classes.