Go to the documentation of this file.
14 #ifndef LLVM_CLANG_STATICANALYZER_CORE_BUGREPORTER_BUGREPORTERVISITORS_H
15 #define LLVM_CLANG_STATICANALYZER_CORE_BUGREPORTER_BUGREPORTERVISITORS_H
21 #include "llvm/ADT/FoldingSet.h"
22 #include "llvm/ADT/IntrusiveRefCntPtr.h"
23 #include "llvm/ADT/STLExtras.h"
24 #include "llvm/ADT/SmallPtrSet.h"
25 #include "llvm/ADT/StringRef.h"
41 class PathSensitiveBugReport;
42 class BugReporterContext;
45 class PathDiagnosticPiece;
85 virtual void Profile(llvm::FoldingSetNodeID &
ID)
const = 0;
93 namespace bugreporter {
169 using ExpressionHandlerPtr = std::unique_ptr<ExpressionHandler>;
170 using StoreHandlerPtr = std::unique_ptr<StoreHandler>;
173 std::list<ExpressionHandlerPtr> ExpressionHandlers;
174 std::list<StoreHandlerPtr> StoreHandlers;
239 TrackingOptions Opts);
246 ExpressionHandlers.push_front(std::move(SH));
254 ExpressionHandlers.push_back(std::move(SH));
262 StoreHandlers.push_front(std::move(SH));
270 StoreHandlers.push_back(std::move(SH));
276 template <
class HandlerType,
class... Args>
279 *
this, std::forward<Args>(ConstructorArgs)...));
285 template <
class HandlerType,
class... Args>
288 *
this, std::forward<Args>(ConstructorArgs)...));
348 : ParentTracker(ParentTracker) {}
381 PathSensitiveBugReport &Report, TrackingOptions Opts = {},
382 const StackFrameContext *Origin =
nullptr);
391 bool IsSatisfied =
false;
396 bool IsTrackingTurnedOn =
false;
400 : Constraint(constraint), Assumption(assumption),
401 IsZeroCheck(!Assumption &&
isa<
Loc>(Constraint)) {}
403 void Profile(llvm::FoldingSetNodeID &
ID)
const override;
407 static const char *
getTag();
422 void Profile(llvm::FoldingSetNodeID &
ID)
const override {
439 constexpr
static llvm::StringLiteral GenericTrueMessage =
440 "Assuming the condition is true";
441 constexpr
static llvm::StringLiteral GenericFalseMessage =
442 "Assuming the condition is false";
445 void Profile(llvm::FoldingSetNodeID &
ID)
const override {
452 static const char *
getTag();
509 bool IsSameFieldName);
522 return static_cast<void *
>(&Tag);
525 void Profile(llvm::FoldingSetNodeID &
ID)
const override {
550 void Profile(llvm::FoldingSetNodeID &
ID)
const override {
567 bool IsSatisfied =
false;
574 bool IsTrackingTurnedOn =
false;
579 void Profile(llvm::FoldingSetNodeID &
ID)
const override;
583 static const char *
getTag();
601 void Profile(llvm::FoldingSetNodeID &
ID)
const override;
610 bool OverwriteConstraintsOnExistingSyms);
616 void Profile(llvm::FoldingSetNodeID &
ID)
const override;
654 bool isModifiedInFrame(
const ExplodedNode *CallExitBeginN);
660 void findModifyingFrames(
const ExplodedNode *
const CallExitBeginN);
737 #endif // LLVM_CLANG_STATICANALYZER_CORE_BUGREPORTER_BUGREPORTERVISITORS_H
Tracker(PathSensitiveBugReport &Report)
The bug visitor will walk all the nodes in a path and collect all the constraints.
Visitor that tracks expressions and values.
void Profile(llvm::FoldingSetNodeID &ID) const override
SVal Value
Symbolic value that is being stored.
BugReporterVisitor()=default
Describes an event when the value got stored into a memory region.
PathDiagnosticPieceRef VisitNode(const ExplodedNode *N, BugReporterContext &BRC, PathSensitiveBugReport &BR) override
Return a diagnostic piece which should be associated with the given node.
PathDiagnosticPieceRef VisitNode(const ExplodedNode *N, BugReporterContext &BRC, PathSensitiveBugReport &R) override
Return a diagnostic piece which should be associated with the given node.
std::shared_ptr< PathDiagnosticPiece > PathDiagnosticPieceRef
void addHighPriorityHandler(StoreHandlerPtr SH)
Add custom store handler with the highest priority.
virtual ~ExpressionHandler()
PathDiagnosticPieceRef constructNote(StoreInfo SI, BugReporterContext &BRC, StringRef NodeText)
static const Expr * getNilReceiver(const Stmt *S, const ExplodedNode *N)
If the statement is a message send expression with nil receiver, returns the receiver expression.
void Profile(llvm::FoldingSetNodeID &ID) const override
void combineWith(const Result &Other)
Combines the current result with the given result.
virtual ~Tracker()=default
void addLowPriorityHandler(ExpressionHandlerPtr SH)
Add custom expression handler with the lowest priority.
bool patternMatch(const Expr *Ex, const Expr *ParentEx, raw_ostream &Out, BugReporterContext &BRC, PathSensitiveBugReport &R, const ExplodedNode *N, std::optional< bool > &prunable, bool IsSameFieldName)
Tracker & getParentTracker()
static const char * getTag()
Return the tag associated with this visitor.
Describes a tracking result with the most basic information of what was actually done (or not done).
virtual PathDiagnosticPieceRef getEndPath(BugReporterContext &BRC, const ExplodedNode *N, PathSensitiveBugReport &BR)
Provide custom definition for the final diagnostic piece on the path - the piece, which is displayed ...
Visitor that tries to report interesting diagnostics from conditions.
PathDiagnosticPieceRef VisitNode(const ExplodedNode *N, BugReporterContext &BRC, PathSensitiveBugReport &BR) override
Return a diagnostic piece which should be associated with the given node.
TrackingKind
Specifies the type of tracking for an expression.
It represents a stack frame of the call stack (based on CallEvent).
bool printValue(const Expr *CondVarExpr, raw_ostream &Out, const ExplodedNode *N, bool TookTrue, bool IsAssuming)
Tries to print the value of the given expression.
BugReporterVisitors are used to add custom diagnostics along a path.
FalsePositiveRefutationBRVisitor()
A generalized component for tracking expressions, values, and stores.
virtual void Profile(llvm::FoldingSetNodeID &ID) const =0
Kind StoreKind
The type of store operation.
PathDiagnosticPieceRef VisitNode(const ExplodedNode *N, BugReporterContext &BR, PathSensitiveBugReport &R) final
Return a diagnostic piece which should be associated with the given node.
virtual Result track(const Expr *E, const ExplodedNode *N, TrackingOptions Opts={})
Track expression value back to its point of origin.
Put a diagnostic on return statement (or on } in its absence) of all inlined functions for which some...
MemRegion - The root abstract class for all memory regions.
PathSensitiveBugReport & getReport()
Represents a single basic block in a source-level CFG.
virtual PathDiagnosticPieceRef handle(StoreInfo SI, BugReporterContext &BRC, TrackingOptions Opts)
Handle the store operation and produce the note.
bool WasInterrupted
Signifies that the tracking was interrupted at some point.
When a region containing undefined value or '0' value is passed as an argument in a call,...
static const char * getTag()
Return the tag associated with this visitor.
TrackConstraintBRVisitor(DefinedSVal constraint, bool assumption)
The visitor detects NoteTags and displays the event notes they contain.
void Profile(llvm::FoldingSetNodeID &ID) const override
virtual Tracker::Result handle(const Expr *E, const ExplodedNode *Original, const ExplodedNode *ExprNode, TrackingOptions Opts)=0
Handle the given expression from the given node.
llvm::ImmutableMap< SymbolRef, RangeSet > ConstraintMap
Represents a call to a C++ constructor.
Handles stores during the tracking.
A builtin binary operation expression such as "x + y" or "x <= y".
Defines a set of options altering tracking behavior.
SuppressInlineDefensiveChecksVisitor(DefinedSVal Val, const ExplodedNode *N)
void addLowPriorityHandler(StoreHandlerPtr SH)
Add custom store handler with the lowest priority.
void addHighPriorityHandler(ExpressionHandlerPtr SH)
Add custom expression handler with the highest priority.
void finalizeVisitor(BugReporterContext &BRC, const ExplodedNode *EndPathNode, PathSensitiveBugReport &BR) override
Last function called on the visitor, no further calls to VisitNode would follow.
PathDiagnosticPieceRef VisitTerminator(const Stmt *Term, const ExplodedNode *N, const CFGBlock *SrcBlk, const CFGBlock *DstBlk, PathSensitiveBugReport &R, BugReporterContext &BRC)
@ Condition
Specifies that a more moderate tracking should be used for the expression value.
virtual void finalizeVisitor(BugReporterContext &BRC, const ExplodedNode *EndPathNode, PathSensitiveBugReport &BR)
Last function called on the visitor, no further calls to VisitNode would follow.
bool isa(CodeGen::Address addr)
void Profile(llvm::FoldingSetNodeID &ID) const override
void Profile(llvm::FoldingSetNodeID &ID) const override
UndefOrNullArgVisitor(const MemRegion *InR)
@ Initialization
The value got stored into the region during initialization: int x = 42;.
virtual ~BugReporterVisitor()
@ Thorough
Default tracking kind – specifies that as much information should be gathered about the tracked expre...
PathDiagnosticPieceRef VisitNode(const ExplodedNode *, BugReporterContext &, PathSensitiveBugReport &) override
Return a diagnostic piece which should be associated with the given node.
virtual PathDiagnosticPieceRef handle(StoreInfo SI, BugReporterContext &BRC, TrackingOptions Opts)=0
Handle the given store and produce the node.
Suppress reports that might lead to known false positives.
bool FoundSomethingToTrack
Usually it means that the tracker added visitors.
void Profile(llvm::FoldingSetNodeID &ID) const override
static const char * getTag()
Return the tag associated with this visitor.
IRgen optimization opportunities The common pattern of short x
PathDiagnosticPieceRef VisitNode(const ExplodedNode *N, BugReporterContext &BRC, PathSensitiveBugReport &BR) override
Return a diagnostic piece which should be associated with the given node.
const MemRegion * Dest
Memory regions involved in the store operation.
bool trackExpressionValue(const ExplodedNode *N, const Expr *E, PathSensitiveBugReport &R, TrackingOptions Opts={})
Attempts to add visitors to track expression value back to its point of origin.
const Expr * getDerefExpr(const Stmt *S)
virtual bool wasModifiedBeforeCallExit(const ExplodedNode *CurrN, const ExplodedNode *CallExitBeginN)
StoreHandler(Tracker &ParentTracker)
void addConstraints(const ExplodedNode *N, bool OverwriteConstraintsOnExistingSyms)
void addLowPriorityHandler(Args &&... ConstructorArgs)
Add custom expression/store handler with the lowest priority.
static bool isPieceMessageGeneric(const PathDiagnosticPiece *Piece)
TrackingBugReporterVisitor(TrackerRef ParentTracker)
virtual PathDiagnosticPieceRef maybeEmitNoteForParameters(PathSensitiveBugReport &R, const CallEvent &Call, const ExplodedNode *N)=0
Consume the information on the non-modifying stack frame in order to either emit a note or not.
Handles expressions during the tracking.
void trackStoredValue(KnownSVal V, const MemRegion *R, PathSensitiveBugReport &Report, TrackingOptions Opts={}, const StackFrameContext *Origin=nullptr)
Track how the value got stored into the given region and where it came from.
static TrackerRef create(PathSensitiveBugReport &Report)
void addHighPriorityHandler(Args &&... ConstructorArgs)
Add custom expression/store handler with the highest priority.
BugReporterVisitor(BugReporterVisitor &&)
Represents any expression that calls an Objective-C method.
NoStateChangeFuncVisitor(bugreporter::TrackingKind TKind)
PathDiagnosticPieceRef VisitTrueTest(const Expr *Cond, BugReporterContext &BRC, PathSensitiveBugReport &R, const ExplodedNode *N, bool TookTrue)
PathDiagnosticPieceRef VisitNode(const ExplodedNode *N, BugReporterContext &BRC, PathSensitiveBugReport &BR) override
Return a diagnostic piece which should be associated with the given node.
bugreporter::TrackingKind TKind
virtual bool wasModifiedInFunction(const ExplodedNode *CallEnterN, const ExplodedNode *CallExitEndN)
@ Assignment
The value got stored into the region during assignment: int x; x = 42;.
static PathDiagnosticPieceRef getDefaultEndPath(const BugReporterContext &BRC, const ExplodedNode *N, const PathSensitiveBugReport &BR)
Generates the default final diagnostic piece.
bool EnableNullFPSuppression
Specifies whether we should employ false positive suppression (inlined defensive checks,...
virtual PathDiagnosticPieceRef maybeEmitNoteForCXXThis(PathSensitiveBugReport &R, const CXXConstructorCall &Call, const ExplodedNode *N)=0
Consume the information on the non-modifying stack frame in order to either emit a note or not.
Stmt - This represents one statement.
const Expr * SourceOfTheValue
The expression where the value comes from.
void Profile(llvm::FoldingSetNodeID &ID) const override
@ BlockCapture
The value got stored into the region as block capture.
ExpressionHandler(Tracker &ParentTracker)
Represents an abstract call to a function or method along a particular path.
PathDiagnosticPieceRef VisitConditionVariable(StringRef LhsString, const Expr *CondVarExpr, BugReporterContext &BRC, PathSensitiveBugReport &R, const ExplodedNode *N, bool TookTrue)
const ExplodedNode * StoreSite
The node where the store happened.
MemberExpr - [C99 6.5.2.3] Structure and Union Members.
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
PathDiagnosticPieceRef VisitNodeImpl(const ExplodedNode *N, BugReporterContext &BRC, PathSensitiveBugReport &BR)
This represents one expression.
PathDiagnosticPieceRef VisitNode(const ExplodedNode *Succ, BugReporterContext &BRC, PathSensitiveBugReport &BR) override
Return a diagnostic piece which should be associated with the given node.
Tracker & getParentTracker()
\Return the tracker that initiated the process.
@ CallArgument
The value got stored into the parameter region as the result of a call.
TrackingKind Kind
Specifies the kind of tracking.
virtual PathDiagnosticPieceRef maybeEmitNoteForObjCSelf(PathSensitiveBugReport &R, const ObjCMethodCall &Call, const ExplodedNode *N)=0
Consume the information on the non-modifying stack frame in order to either emit a note or not.
Tracker & getParentTracker()
A reference to a declared variable, function, enum, etc.
virtual PathDiagnosticPieceRef VisitNode(const ExplodedNode *Succ, BugReporterContext &BRC, PathSensitiveBugReport &BR)=0
Return a diagnostic piece which should be associated with the given node.
void Profile(llvm::FoldingSetNodeID &ID) const override
void finalizeVisitor(BugReporterContext &BRC, const ExplodedNode *N, PathSensitiveBugReport &BR) override
Last function called on the visitor, no further calls to VisitNode would follow.
PathDiagnosticPieceRef VisitNode(const ExplodedNode *N, BugReporterContext &BRC, PathSensitiveBugReport &BR) override
Return a diagnostic piece which should be associated with the given node.