clang  8.0.0svn
BuiltinFunctionChecker.cpp
Go to the documentation of this file.
1 //=== BuiltinFunctionChecker.cpp --------------------------------*- C++ -*-===//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This checker evaluates clang builtin functions.
11 //
12 //===----------------------------------------------------------------------===//
13 
14 #include "ClangSACheckers.h"
15 #include "clang/Basic/Builtins.h"
19 
20 using namespace clang;
21 using namespace ento;
22 
23 namespace {
24 
25 class BuiltinFunctionChecker : public Checker<eval::Call> {
26 public:
27  bool evalCall(const CallExpr *CE, CheckerContext &C) const;
28 };
29 
30 }
31 
32 bool BuiltinFunctionChecker::evalCall(const CallExpr *CE,
33  CheckerContext &C) const {
34  ProgramStateRef state = C.getState();
35  const FunctionDecl *FD = C.getCalleeDecl(CE);
36  const LocationContext *LCtx = C.getLocationContext();
37  if (!FD)
38  return false;
39 
40  switch (FD->getBuiltinID()) {
41  default:
42  return false;
43 
44  case Builtin::BI__builtin_assume: {
45  assert (CE->arg_begin() != CE->arg_end());
46  SVal ArgSVal = C.getSVal(CE->getArg(0));
47  if (ArgSVal.isUndef())
48  return true; // Return true to model purity.
49 
50  state = state->assume(ArgSVal.castAs<DefinedOrUnknownSVal>(), true);
51  // FIXME: do we want to warn here? Not right now. The most reports might
52  // come from infeasible paths, thus being false positives.
53  if (!state) {
54  C.generateSink(C.getState(), C.getPredecessor());
55  return true;
56  }
57 
58  C.addTransition(state);
59  return true;
60  }
61 
62  case Builtin::BI__builtin_unpredictable:
63  case Builtin::BI__builtin_expect:
64  case Builtin::BI__builtin_assume_aligned:
65  case Builtin::BI__builtin_addressof: {
66  // For __builtin_unpredictable, __builtin_expect, and
67  // __builtin_assume_aligned, just return the value of the subexpression.
68  // __builtin_addressof is going from a reference to a pointer, but those
69  // are represented the same way in the analyzer.
70  assert (CE->arg_begin() != CE->arg_end());
71  SVal X = C.getSVal(*(CE->arg_begin()));
72  C.addTransition(state->BindExpr(CE, LCtx, X));
73  return true;
74  }
75 
76  case Builtin::BI__builtin_alloca_with_align:
77  case Builtin::BI__builtin_alloca: {
78  // FIXME: Refactor into StoreManager itself?
79  MemRegionManager& RM = C.getStoreManager().getRegionManager();
80  const AllocaRegion* R =
81  RM.getAllocaRegion(CE, C.blockCount(), C.getLocationContext());
82 
83  // Set the extent of the region in bytes. This enables us to use the
84  // SVal of the argument directly. If we save the extent in bits, we
85  // cannot represent values like symbol*8.
86  auto Size = C.getSVal(*(CE->arg_begin())).castAs<DefinedOrUnknownSVal>();
87 
88  SValBuilder& svalBuilder = C.getSValBuilder();
89  DefinedOrUnknownSVal Extent = R->getExtent(svalBuilder);
90  DefinedOrUnknownSVal extentMatchesSizeArg =
91  svalBuilder.evalEQ(state, Extent, Size);
92  state = state->assume(extentMatchesSizeArg, true);
93  assert(state && "The region should not have any previous constraints");
94 
95  C.addTransition(state->BindExpr(CE, LCtx, loc::MemRegionVal(R)));
96  return true;
97  }
98 
99  case Builtin::BI__builtin_object_size:
100  case Builtin::BI__builtin_constant_p: {
101  // This must be resolvable at compile time, so we defer to the constant
102  // evaluator for a value.
103  SVal V = UnknownVal();
104  llvm::APSInt Result;
105  if (CE->EvaluateAsInt(Result, C.getASTContext(), Expr::SE_NoSideEffects)) {
106  // Make sure the result has the correct type.
107  SValBuilder &SVB = C.getSValBuilder();
108  BasicValueFactory &BVF = SVB.getBasicValueFactory();
109  BVF.getAPSIntType(CE->getType()).apply(Result);
110  V = SVB.makeIntVal(Result);
111  }
112 
113  C.addTransition(state->BindExpr(CE, LCtx, V));
114  return true;
115  }
116  }
117 }
118 
119 void ento::registerBuiltinFunctionChecker(CheckerManager &mgr) {
120  mgr.registerChecker<BuiltinFunctionChecker>();
121 }
Represents a function declaration or definition.
Definition: Decl.h:1732
Expr * getArg(unsigned Arg)
getArg - Return the specified argument.
Definition: Expr.h:2354
IntrusiveRefCntPtr< const ProgramState > ProgramStateRef
Strictly evaluate the expression.
Definition: Expr.h:594
bool EvaluateAsInt(llvm::APSInt &Result, const ASTContext &Ctx, SideEffectsKind AllowSideEffects=SE_NoSideEffects) const
EvaluateAsInt - Return true if this is a constant which we can fold and convert to an integer...
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
arg_iterator arg_end()
Definition: Expr.h:2385
QualType getType() const
Definition: Expr.h:127
Dataflow Directional Tag Classes.
arg_iterator arg_begin()
Definition: Expr.h:2384
X
Add a minimal nested name specifier fixit hint to allow lookup of a tag name from an outer enclosing ...
Definition: SemaDecl.cpp:13803
unsigned getBuiltinID() const
Returns a value indicating whether this function corresponds to a builtin function.
Definition: Decl.cpp:2976
CallExpr - Represents a function call (C99 6.5.2.2, C++ [expr.call]).
Definition: Expr.h:2285
Defines enum values for all the target-independent builtin functions.