clang  17.0.0git
CheckerContext.h
Go to the documentation of this file.
1 //== CheckerContext.h - Context info for path-sensitive checkers--*- C++ -*--=//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file defines CheckerContext that provides contextual info for
10 // path-sensitive checkers.
11 //
12 //===----------------------------------------------------------------------===//
13 
14 #ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CHECKERCONTEXT_H
15 #define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CHECKERCONTEXT_H
16 
19 #include <optional>
20 
21 namespace clang {
22 namespace ento {
23 
25  ExprEngine &Eng;
26  /// The current exploded(symbolic execution) graph node.
27  ExplodedNode *Pred;
28  /// The flag is true if the (state of the execution) has been modified
29  /// by the checker using this context. For example, a new transition has been
30  /// added or a bug report issued.
31  bool Changed;
32  /// The tagged location, which is used to generate all new nodes.
33  const ProgramPoint Location;
34  NodeBuilder &NB;
35 
36 public:
37  /// If we are post visiting a call, this flag will be set if the
38  /// call was inlined. In all other cases it will be false.
39  const bool wasInlined;
40 
42  ExprEngine &eng,
43  ExplodedNode *pred,
44  const ProgramPoint &loc,
45  bool wasInlined = false)
46  : Eng(eng),
47  Pred(pred),
48  Changed(false),
49  Location(loc),
50  NB(builder),
52  assert(Pred->getState() &&
53  "We should not call the checkers on an empty state.");
54  }
55 
57  return Eng.getAnalysisManager();
58  }
59 
61  return Eng.getConstraintManager();
62  }
63 
65  return Eng.getStoreManager();
66  }
67 
68  /// Returns the previous node in the exploded graph, which includes
69  /// the state of the program before the checker ran. Note, checkers should
70  /// not retain the node in their state since the nodes might get invalidated.
71  ExplodedNode *getPredecessor() { return Pred; }
72  const ProgramStateRef &getState() const { return Pred->getState(); }
73 
74  /// Check if the checker changed the state of the execution; ex: added
75  /// a new transition or a bug report.
76  bool isDifferent() { return Changed; }
77 
78  /// Returns the number of times the current block has been visited
79  /// along the analyzed path.
80  unsigned blockCount() const {
81  return NB.getContext().blockCount();
82  }
83 
85  return Eng.getContext();
86  }
87 
88  const ASTContext &getASTContext() const { return Eng.getContext(); }
89 
90  const LangOptions &getLangOpts() const {
91  return Eng.getContext().getLangOpts();
92  }
93 
95  return Pred->getLocationContext();
96  }
97 
99  return Pred->getStackFrame();
100  }
101 
102  /// Return true if the current LocationContext has no caller context.
103  bool inTopFrame() const { return getLocationContext()->inTopFrame(); }
104 
106  return Eng.getBugReporter();
107  }
108 
110  return getBugReporter().getSourceManager();
111  }
112 
114 
116  return Eng.getSValBuilder();
117  }
118 
120  return getSValBuilder().getSymbolManager();
121  }
122 
124  return Eng.getStateManager();
125  }
126 
128  return Pred->getLocationContext()->getAnalysisDeclContext();
129  }
130 
131  /// Get the blockID.
132  unsigned getBlockID() const {
133  return NB.getContext().getBlock()->getBlockID();
134  }
135 
136  /// If the given node corresponds to a PostStore program point,
137  /// retrieve the location region as it was uttered in the code.
138  ///
139  /// This utility can be useful for generating extensive diagnostics, for
140  /// example, for finding variables that the given symbol was assigned to.
142  ProgramPoint L = N->getLocation();
143  if (std::optional<PostStore> PSL = L.getAs<PostStore>())
144  return reinterpret_cast<const MemRegion*>(PSL->getLocationValue());
145  return nullptr;
146  }
147 
148  /// Get the value of arbitrary expressions at this point in the path.
149  SVal getSVal(const Stmt *S) const {
150  return Pred->getSVal(S);
151  }
152 
153  /// Returns true if the value of \p E is greater than or equal to \p
154  /// Val under unsigned comparison
155  bool isGreaterOrEqual(const Expr *E, unsigned long long Val);
156 
157  /// Returns true if the value of \p E is negative.
158  bool isNegative(const Expr *E);
159 
160  /// Generates a new transition in the program state graph
161  /// (ExplodedGraph). Uses the default CheckerContext predecessor node.
162  ///
163  /// @param State The state of the generated node. If not specified, the state
164  /// will not be changed, but the new node will have the checker's tag.
165  /// @param Tag The tag is used to uniquely identify the creation site. If no
166  /// tag is specified, a default tag, unique to the given checker,
167  /// will be used. Tags are used to prevent states generated at
168  /// different sites from caching out.
170  const ProgramPointTag *Tag = nullptr) {
171  return addTransitionImpl(State ? State : getState(), false, nullptr, Tag);
172  }
173 
174  /// Generates a new transition with the given predecessor.
175  /// Allows checkers to generate a chain of nodes.
176  ///
177  /// @param State The state of the generated node.
178  /// @param Pred The transition will be generated from the specified Pred node
179  /// to the newly generated node.
180  /// @param Tag The tag to uniquely identify the creation site.
182  const ProgramPointTag *Tag = nullptr) {
183  return addTransitionImpl(State, false, Pred, Tag);
184  }
185 
186  /// Generate a sink node. Generating a sink stops exploration of the
187  /// given path. To create a sink node for the purpose of reporting an error,
188  /// checkers should use generateErrorNode() instead.
190  const ProgramPointTag *Tag = nullptr) {
191  return addTransitionImpl(State ? State : getState(), true, Pred, Tag);
192  }
193 
194  /// Add a sink node to the current path of execution, halting analysis.
195  void addSink(ProgramStateRef State = nullptr,
196  const ProgramPointTag *Tag = nullptr) {
197  if (!State)
198  State = getState();
200  }
201 
202  /// Generate a transition to a node that will be used to report
203  /// an error. This node will be a sink. That is, it will stop exploration of
204  /// the given path.
205  ///
206  /// @param State The state of the generated node.
207  /// @param Tag The tag to uniquely identify the creation site. If null,
208  /// the default tag for the checker will be used.
210  const ProgramPointTag *Tag = nullptr) {
211  return generateSink(State, Pred,
212  (Tag ? Tag : Location.getTag()));
213  }
214 
215  /// Generate a transition to a node that will be used to report
216  /// an error. This node will be a sink. That is, it will stop exploration of
217  /// the given path.
218  ///
219  /// @param State The state of the generated node.
220  /// @param Pred The transition will be generated from the specified Pred node
221  /// to the newly generated node.
222  /// @param Tag The tag to uniquely identify the creation site. If null,
223  /// the default tag for the checker will be used.
225  ExplodedNode *Pred,
226  const ProgramPointTag *Tag = nullptr) {
227  return generateSink(State, Pred,
228  (Tag ? Tag : Location.getTag()));
229  }
230 
231  /// Generate a transition to a node that will be used to report
232  /// an error. This node will not be a sink. That is, exploration will
233  /// continue along this path.
234  ///
235  /// @param State The state of the generated node.
236  /// @param Tag The tag to uniquely identify the creation site. If null,
237  /// the default tag for the checker will be used.
238  ExplodedNode *
240  const ProgramPointTag *Tag = nullptr) {
241  return addTransition(State, (Tag ? Tag : Location.getTag()));
242  }
243 
244  /// Generate a transition to a node that will be used to report
245  /// an error. This node will not be a sink. That is, exploration will
246  /// continue along this path.
247  ///
248  /// @param State The state of the generated node.
249  /// @param Pred The transition will be generated from the specified Pred node
250  /// to the newly generated node.
251  /// @param Tag The tag to uniquely identify the creation site. If null,
252  /// the default tag for the checker will be used.
253  ExplodedNode *
255  ExplodedNode *Pred,
256  const ProgramPointTag *Tag = nullptr) {
257  return addTransition(State, Pred, (Tag ? Tag : Location.getTag()));
258  }
259 
260  /// Emit the diagnostics report.
261  void emitReport(std::unique_ptr<BugReport> R) {
262  Changed = true;
263  Eng.getBugReporter().emitReport(std::move(R));
264  }
265 
266  /// Produce a program point tag that displays an additional path note
267  /// to the user. This is a lightweight alternative to the
268  /// BugReporterVisitor mechanism: instead of visiting the bug report
269  /// node-by-node to restore the sequence of events that led to discovering
270  /// a bug, you can add notes as you add your transitions.
271  ///
272  /// @param Cb Callback with 'BugReporterContext &, BugReport &' parameters.
273  /// @param IsPrunable Whether the note is prunable. It allows BugReporter
274  /// to omit the note from the report if it would make the displayed
275  /// bug path significantly shorter.
276  LLVM_ATTRIBUTE_RETURNS_NONNULL
277  const NoteTag *getNoteTag(NoteTag::Callback &&Cb, bool IsPrunable = false) {
278  return Eng.getDataTags().make<NoteTag>(std::move(Cb), IsPrunable);
279  }
280 
281  /// A shorthand version of getNoteTag that doesn't require you to accept
282  /// the 'BugReporterContext' argument when you don't need it.
283  ///
284  /// @param Cb Callback only with 'BugReport &' parameter.
285  /// @param IsPrunable Whether the note is prunable. It allows BugReporter
286  /// to omit the note from the report if it would make the displayed
287  /// bug path significantly shorter.
288  const NoteTag
290  bool IsPrunable = false) {
291  return getNoteTag(
292  [Cb](BugReporterContext &,
293  PathSensitiveBugReport &BR) { return Cb(BR); },
294  IsPrunable);
295  }
296 
297  /// A shorthand version of getNoteTag that doesn't require you to accept
298  /// the arguments when you don't need it.
299  ///
300  /// @param Cb Callback without parameters.
301  /// @param IsPrunable Whether the note is prunable. It allows BugReporter
302  /// to omit the note from the report if it would make the displayed
303  /// bug path significantly shorter.
304  const NoteTag *getNoteTag(std::function<std::string()> &&Cb,
305  bool IsPrunable = false) {
306  return getNoteTag([Cb](BugReporterContext &,
307  PathSensitiveBugReport &) { return Cb(); },
308  IsPrunable);
309  }
310 
311  /// A shorthand version of getNoteTag that accepts a plain note.
312  ///
313  /// @param Note The note.
314  /// @param IsPrunable Whether the note is prunable. It allows BugReporter
315  /// to omit the note from the report if it would make the displayed
316  /// bug path significantly shorter.
317  const NoteTag *getNoteTag(StringRef Note, bool IsPrunable = false) {
318  return getNoteTag(
319  [Note](BugReporterContext &,
320  PathSensitiveBugReport &) { return std::string(Note); },
321  IsPrunable);
322  }
323 
324  /// A shorthand version of getNoteTag that accepts a lambda with stream for
325  /// note.
326  ///
327  /// @param Cb Callback with 'BugReport &' and 'llvm::raw_ostream &'.
328  /// @param IsPrunable Whether the note is prunable. It allows BugReporter
329  /// to omit the note from the report if it would make the displayed
330  /// bug path significantly shorter.
332  std::function<void(PathSensitiveBugReport &BR, llvm::raw_ostream &OS)> &&Cb,
333  bool IsPrunable = false) {
334  return getNoteTag(
335  [Cb](PathSensitiveBugReport &BR) -> std::string {
337  llvm::raw_svector_ostream OS(Str);
338  Cb(BR, OS);
339  return std::string(OS.str());
340  },
341  IsPrunable);
342  }
343 
344  /// Returns the word that should be used to refer to the declaration
345  /// in the report.
346  StringRef getDeclDescription(const Decl *D);
347 
348  /// Get the declaration of the called function (path-sensitive).
349  const FunctionDecl *getCalleeDecl(const CallExpr *CE) const;
350 
351  /// Get the name of the called function (path-sensitive).
352  StringRef getCalleeName(const FunctionDecl *FunDecl) const;
353 
354  /// Get the identifier of the called function (path-sensitive).
355  const IdentifierInfo *getCalleeIdentifier(const CallExpr *CE) const {
356  const FunctionDecl *FunDecl = getCalleeDecl(CE);
357  if (FunDecl)
358  return FunDecl->getIdentifier();
359  else
360  return nullptr;
361  }
362 
363  /// Get the name of the called function (path-sensitive).
364  StringRef getCalleeName(const CallExpr *CE) const {
365  const FunctionDecl *FunDecl = getCalleeDecl(CE);
366  return getCalleeName(FunDecl);
367  }
368 
369  /// Returns true if the callee is an externally-visible function in the
370  /// top-level namespace, such as \c malloc.
371  ///
372  /// If a name is provided, the function must additionally match the given
373  /// name.
374  ///
375  /// Note that this deliberately excludes C++ library functions in the \c std
376  /// namespace, but will include C library functions accessed through the
377  /// \c std namespace. This also does not check if the function is declared
378  /// as 'extern "C"', or if it uses C++ name mangling.
379  static bool isCLibraryFunction(const FunctionDecl *FD,
380  StringRef Name = StringRef());
381 
382  /// Depending on wither the location corresponds to a macro, return
383  /// either the macro name or the token spelling.
384  ///
385  /// This could be useful when checkers' logic depends on whether a function
386  /// is called with a given macro argument. For example:
387  /// s = socket(AF_INET,..)
388  /// If AF_INET is a macro, the result should be treated as a source of taint.
389  ///
390  /// \sa clang::Lexer::getSpelling(), clang::Lexer::getImmediateMacroName().
392 
393 private:
394  ExplodedNode *addTransitionImpl(ProgramStateRef State,
395  bool MarkAsSink,
396  ExplodedNode *P = nullptr,
397  const ProgramPointTag *Tag = nullptr) {
398  // The analyzer may stop exploring if it sees a state it has previously
399  // visited ("cache out"). The early return here is a defensive check to
400  // prevent accidental caching out by checker API clients. Unless there is a
401  // tag or the client checker has requested that the generated node be
402  // marked as a sink, we assume that a client requesting a transition to a
403  // state that is the same as the predecessor state has made a mistake. We
404  // return the predecessor rather than cache out.
405  //
406  // TODO: We could potentially change the return to an assertion to alert
407  // clients to their mistake, but several checkers (including
408  // DereferenceChecker, CallAndMessageChecker, and DynamicTypePropagation)
409  // rely upon the defensive behavior and would need to be updated.
410  if (!State || (State == Pred->getState() && !Tag && !MarkAsSink))
411  return Pred;
412 
413  Changed = true;
414  const ProgramPoint &LocalLoc = (Tag ? Location.withTag(Tag) : Location);
415  if (!P)
416  P = Pred;
417 
419  if (MarkAsSink)
420  node = NB.generateSink(LocalLoc, State, P);
421  else
422  node = NB.generateNode(LocalLoc, State, P);
423  return node;
424  }
425 };
426 
427 } // end GR namespace
428 
429 } // end clang namespace
430 
431 #endif
clang::ento::CheckerContext::getCalleeName
StringRef getCalleeName(const CallExpr *CE) const
Get the name of the called function (path-sensitive).
Definition: CheckerContext.h:364
clang::ento::ExprEngine::getStateManager
ProgramStateManager & getStateManager()
Definition: ExprEngine.h:418
clang::ProgramPoint::withTag
ProgramPoint withTag(const ProgramPointTag *tag) const
Create a new ProgramPoint object that is the same as the original except for using the specified tag ...
Definition: ProgramPoint.h:131
clang::ento::ExplodedNode::getLocationContext
const LocationContext * getLocationContext() const
Definition: ExplodedGraph.h:146
clang::LocationContext
It wraps the AnalysisDeclContext to represent both the call stack with the help of StackFrameContext ...
Definition: AnalysisDeclContext.h:215
string
string(SUBSTRING ${CMAKE_CURRENT_BINARY_DIR} 0 ${PATH_LIB_START} PATH_HEAD) string(SUBSTRING $
Definition: CMakeLists.txt:23
clang::ento::CheckerContext::getASTContext
const ASTContext & getASTContext() const
Definition: CheckerContext.h:88
clang::ento::CheckerContext::generateErrorNode
ExplodedNode * generateErrorNode(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
Generate a transition to a node that will be used to report an error.
Definition: CheckerContext.h:224
clang::ento::CheckerContext::getDeclDescription
StringRef getDeclDescription(const Decl *D)
Returns the word that should be used to refer to the declaration in the report.
Definition: CheckerContext.cpp:40
clang::ento::CheckerContext::getNoteTag
const NoteTag * getNoteTag(StringRef Note, bool IsPrunable=false)
A shorthand version of getNoteTag that accepts a plain note.
Definition: CheckerContext.h:317
clang::ento::ConstraintManager
Definition: ConstraintManager.h:69
clang::ento::ExprEngine::getDataTags
DataTag::Factory & getDataTags()
Definition: ExprEngine.h:434
clang::ProgramPointTag
ProgramPoints can be "tagged" as representing points specific to a given analysis entity.
Definition: ProgramPoint.h:38
clang::SourceLocation
Encodes a location in the source.
Definition: SourceLocation.h:86
clang::ento::ExprEngine::getContext
ASTContext & getContext() const
getContext - Return the ASTContext associated with this analysis.
Definition: ExprEngine.h:204
clang::ento::CheckerContext::getLocationContext
const LocationContext * getLocationContext() const
Definition: CheckerContext.h:94
clang::CFGBlock::getBlockID
unsigned getBlockID() const
Definition: CFG.h:1074
clang::ento::CheckerContext::getCalleeDecl
const FunctionDecl * getCalleeDecl(const CallExpr *CE) const
Get the declaration of the called function (path-sensitive).
Definition: CheckerContext.cpp:21
clang::AnalysisDeclContext
AnalysisDeclContext contains the context data for the function, method or block under analysis.
Definition: AnalysisDeclContext.h:72
clang::ento::ExplodedNode::getStackFrame
const StackFrameContext * getStackFrame() const
Definition: ExplodedGraph.h:150
clang::ento::CheckerContext::generateNonFatalErrorNode
ExplodedNode * generateNonFatalErrorNode(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generate a transition to a node that will be used to report an error.
Definition: CheckerContext.h:239
clang::ento::ExplodedNode
Definition: ExplodedGraph.h:65
clang::ento::CheckerContext::getStoreManager
StoreManager & getStoreManager()
Definition: CheckerContext.h:64
clang::ento::CheckerContext::getNoteTag
const NoteTag * getNoteTag(std::function< std::string()> &&Cb, bool IsPrunable=false)
A shorthand version of getNoteTag that doesn't require you to accept the arguments when you don't nee...
Definition: CheckerContext.h:304
clang::ento::CheckerContext::addSink
void addSink(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Add a sink node to the current path of execution, halting analysis.
Definition: CheckerContext.h:195
clang::ento::CheckerContext::getLocationRegionIfPostStore
static const MemRegion * getLocationRegionIfPostStore(const ExplodedNode *N)
If the given node corresponds to a PostStore program point, retrieve the location region as it was ut...
Definition: CheckerContext.h:141
clang::ento::CheckerContext::isGreaterOrEqual
bool isGreaterOrEqual(const Expr *E, unsigned long long Val)
Returns true if the value of E is greater than or equal to Val under unsigned comparison.
Definition: CheckerContext.cpp:147
clang::StackFrameContext
It represents a stack frame of the call stack (based on CallEvent).
Definition: AnalysisDeclContext.h:299
clang::ento::CheckerContext::getCurrentAnalysisDeclContext
AnalysisDeclContext * getCurrentAnalysisDeclContext() const
Definition: CheckerContext.h:127
clang::ento::CheckerContext::generateErrorNode
ExplodedNode * generateErrorNode(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generate a transition to a node that will be used to report an error.
Definition: CheckerContext.h:209
clang::ento::CheckerContext::getState
const ProgramStateRef & getState() const
Definition: CheckerContext.h:72
clang::ento::CheckerContext::getPreprocessor
Preprocessor & getPreprocessor()
Definition: CheckerContext.h:113
clang::ento::StoreManager
Definition: Store.h:53
clang::SourceManager
This class handles loading and caching of source files into memory.
Definition: SourceManager.h:638
clang::ento::MemRegion
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:95
clang::ento::CheckerContext::getCalleeIdentifier
const IdentifierInfo * getCalleeIdentifier(const CallExpr *CE) const
Get the identifier of the called function (path-sensitive).
Definition: CheckerContext.h:355
clang::ento::ExplodedNode::getState
const ProgramStateRef & getState() const
Definition: ExplodedGraph.h:168
clang::ento::NodeBuilder
Definition: CoreEngine.h:247
clang::ento::NodeBuilder::generateSink
ExplodedNode * generateSink(const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred)
Generates a sink in the ExplodedGraph.
Definition: CoreEngine.h:313
clang::ento::BugReporter::emitReport
virtual void emitReport(std::unique_ptr< BugReport > R)
Add the given report to the set of reports tracked by BugReporter.
Definition: BugReporter.cpp:2897
clang::ento::BugReporter::getPreprocessor
Preprocessor & getPreprocessor()
Definition: BugReporter.h:620
clang::ento::DataTag::Factory::make
const DataTagType * make(Args &&... ConstructorArgs)
Definition: BugReporter.h:748
clang::LocationContext::inTopFrame
virtual bool inTopFrame() const
Definition: AnalysisDeclContext.cpp:472
clang::ento::CheckerContext::getAnalysisManager
AnalysisManager & getAnalysisManager()
Definition: CheckerContext.h:56
clang::ASTContext
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:182
clang::ento::CheckerContext::getCalleeName
StringRef getCalleeName(const FunctionDecl *FunDecl) const
Get the name of the called function (path-sensitive).
Definition: CheckerContext.cpp:31
clang::ProgramPoint::getTag
const ProgramPointTag * getTag() const
Definition: ProgramPoint.h:175
clang::PostStore
Represents a program point after a store evaluation.
Definition: ProgramPoint.h:429
clang::ento::CheckerContext::getSymbolManager
SymbolManager & getSymbolManager()
Definition: CheckerContext.h:119
clang::ento::CheckerContext::getNoteTag
const NoteTag * getNoteTag(std::function< void(PathSensitiveBugReport &BR, llvm::raw_ostream &OS)> &&Cb, bool IsPrunable=false)
A shorthand version of getNoteTag that accepts a lambda with stream for note.
Definition: CheckerContext.h:331
clang::ento::CheckerContext::addTransition
ExplodedNode * addTransition(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generates a new transition in the program state graph (ExplodedGraph).
Definition: CheckerContext.h:169
llvm::SmallString< 128 >
clang::ento::CheckerContext::emitReport
void emitReport(std::unique_ptr< BugReport > R)
Emit the diagnostics report.
Definition: CheckerContext.h:261
clang::ento::BugReporterContext
Definition: BugReporter.h:701
clang::ento::CheckerContext::inTopFrame
bool inTopFrame() const
Return true if the current LocationContext has no caller context.
Definition: CheckerContext.h:103
clang::ento::BugReporter
BugReporter is a utility class for generating PathDiagnostics for analysis.
Definition: BugReporter.h:585
clang::ento::NodeBuilderContext::blockCount
unsigned blockCount() const
Returns the number of times the current basic block has been visited on the exploded graph path.
Definition: CoreEngine.h:231
clang::ento::CheckerContext::getMacroNameOrSpelling
StringRef getMacroNameOrSpelling(SourceLocation &Loc)
Depending on wither the location corresponds to a macro, return either the macro name or the token sp...
Definition: CheckerContext.cpp:116
clang::ento::CheckerContext::getStateManager
ProgramStateManager & getStateManager()
Definition: CheckerContext.h:123
clang::ento::CheckerContext::getSourceManager
const SourceManager & getSourceManager()
Definition: CheckerContext.h:109
clang::ento::CheckerContext::getLangOpts
const LangOptions & getLangOpts() const
Definition: CheckerContext.h:90
clang::ento::Loc
Definition: SVals.h:281
clang::ento::CheckerContext::getSValBuilder
SValBuilder & getSValBuilder()
Definition: CheckerContext.h:115
clang::ento::CheckerContext::getPredecessor
ExplodedNode * getPredecessor()
Returns the previous node in the exploded graph, which includes the state of the program before the c...
Definition: CheckerContext.h:71
clang::ento::ExprEngine::getConstraintManager
ConstraintManager & getConstraintManager()
Definition: ExprEngine.h:422
clang::ento::SValBuilder
Definition: SValBuilder.h:53
clang::LocationContext::getAnalysisDeclContext
LLVM_ATTRIBUTE_RETURNS_NONNULL AnalysisDeclContext * getAnalysisDeclContext() const
Definition: AnalysisDeclContext.h:244
clang::ento::NodeBuilder::getContext
const NodeBuilderContext & getContext()
Definition: CoreEngine.h:339
clang::ento::CheckerContext::getNoteTag
const NoteTag * getNoteTag(std::function< std::string(PathSensitiveBugReport &)> &&Cb, bool IsPrunable=false)
A shorthand version of getNoteTag that doesn't require you to accept the 'BugReporterContext' argumen...
Definition: CheckerContext.h:289
P
StringRef P
Definition: ASTMatchersInternal.cpp:564
clang::ento::ProgramStateManager
Definition: ProgramState.h:503
clang::ento::BugReporter::getSourceManager
const SourceManager & getSourceManager()
Definition: BugReporter.h:616
clang::ento::CheckerContext::getASTContext
ASTContext & getASTContext()
Definition: CheckerContext.h:84
false
#define false
Definition: stdbool.h:22
clang::NamedDecl::getIdentifier
IdentifierInfo * getIdentifier() const
Get the identifier that names this declaration, if there is one.
Definition: Decl.h:268
clang::ProgramPoint::getAs
std::optional< T > getAs() const
Convert to the specified ProgramPoint type, returning std::nullopt if this ProgramPoint is not of the...
Definition: ProgramPoint.h:149
clang::Decl
Decl - This represents one declaration (or definition), e.g.
Definition: DeclBase.h:83
State
LineState State
Definition: UnwrappedLineFormatter.cpp:1147
clang::ento::ExprEngine::getSValBuilder
SValBuilder & getSValBuilder()
Definition: ExprEngine.h:216
clang::ento::ExprEngine::getBugReporter
BugReporter & getBugReporter()
Definition: ExprEngine.h:218
clang::ento::AnalysisManager
Definition: AnalysisManager.h:31
clang::IdentifierInfo
One of these records is kept for each identifier that is lexed.
Definition: IdentifierTable.h:85
clang::ento::ExprEngine::getAnalysisManager
AnalysisManager & getAnalysisManager()
Definition: ExprEngine.h:206
clang::ento::CheckerContext::isCLibraryFunction
static bool isCLibraryFunction(const FunctionDecl *FD, StringRef Name=StringRef())
Returns true if the callee is an externally-visible function in the top-level namespace,...
Definition: CheckerContext.cpp:48
clang::LangOptions
Keeps track of the various options that can be enabled, which controls the dialect of C or C++ that i...
Definition: LangOptions.h:82
clang::ento::ExprEngine
Definition: ExprEngine.h:124
clang::ento::CheckerContext::addTransition
ExplodedNode * addTransition(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
Generates a new transition with the given predecessor.
Definition: CheckerContext.h:181
clang::ento::PathSensitiveBugReport
Definition: BugReporter.h:289
ExprEngine.h
clang::ento::CheckerContext::getBugReporter
BugReporter & getBugReporter()
Definition: CheckerContext.h:105
clang::ento::ExprEngine::getStoreManager
StoreManager & getStoreManager()
Definition: ExprEngine.h:420
clang::ento::CheckerContext::isNegative
bool isNegative(const Expr *E)
Returns true if the value of E is negative.
Definition: CheckerContext.cpp:152
clang::ento::CheckerContext::generateNonFatalErrorNode
ExplodedNode * generateNonFatalErrorNode(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
Generate a transition to a node that will be used to report an error.
Definition: CheckerContext.h:254
clang::ento::CheckerContext::getStackFrame
const StackFrameContext * getStackFrame() const
Definition: CheckerContext.h:98
clang
Definition: CalledOnceCheck.h:17
clang::ento::ExplodedNode::getLocation
ProgramPoint getLocation() const
getLocation - Returns the edge associated with the given node.
Definition: ExplodedGraph.h:144
clang::Stmt
Stmt - This represents one statement.
Definition: Stmt.h:72
clang::ento::NodeBuilder::generateNode
ExplodedNode * generateNode(const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred)
Generates a node in the ExplodedGraph.
Definition: CoreEngine.h:300
clang::ento::CheckerContext::generateSink
ExplodedNode * generateSink(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
Generate a sink node.
Definition: CheckerContext.h:189
clang::ento::NodeBuilderContext::getBlock
const CFGBlock * getBlock() const
Return the CFGBlock associated with this builder.
Definition: CoreEngine.h:227
clang::ento::CheckerContext::getBlockID
unsigned getBlockID() const
Get the blockID.
Definition: CheckerContext.h:132
clang::ento::ExplodedNode::getSVal
SVal getSVal(const Stmt *S) const
Get the value of an arbitrary expression at this node.
Definition: ExplodedGraph.h:175
clang::ento::SValBuilder::getSymbolManager
SymbolManager & getSymbolManager()
Definition: SValBuilder.h:152
clang::ento::CheckerContext
Definition: CheckerContext.h:24
clang::ento::CheckerContext::CheckerContext
CheckerContext(NodeBuilder &builder, ExprEngine &eng, ExplodedNode *pred, const ProgramPoint &loc, bool wasInlined=false)
Definition: CheckerContext.h:41
clang::ento::SVal
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
Definition: SVals.h:72
clang::transformer::node
RangeSelector node(std::string ID)
Selects a node, including trailing semicolon, if any (for declarations and non-expression statements)...
Definition: RangeSelector.cpp:141
ProgramStateTrait.h
clang::Expr
This represents one expression.
Definition: Expr.h:110
clang::ento::CheckerContext::getConstraintManager
ConstraintManager & getConstraintManager()
Definition: CheckerContext.h:60
clang::Preprocessor
Engages in a tight little dance with the lexer to efficiently preprocess tokens.
Definition: Preprocessor.h:128
clang::ento::CheckerContext::getNoteTag
const LLVM_ATTRIBUTE_RETURNS_NONNULL NoteTag * getNoteTag(NoteTag::Callback &&Cb, bool IsPrunable=false)
Produce a program point tag that displays an additional path note to the user.
Definition: CheckerContext.h:277
clang::ento::CheckerContext::wasInlined
const bool wasInlined
If we are post visiting a call, this flag will be set if the call was inlined.
Definition: CheckerContext.h:39
clang::ento::CheckerContext::getSVal
SVal getSVal(const Stmt *S) const
Get the value of arbitrary expressions at this point in the path.
Definition: CheckerContext.h:149
clang::ento::NoteTag
The tag upon which the TagVisitor reacts.
Definition: BugReporter.h:763
clang::ento::NoteTag::Callback
std::function< std::string(BugReporterContext &, PathSensitiveBugReport &)> Callback
Definition: BugReporter.h:766
clang::FunctionDecl
Represents a function declaration or definition.
Definition: Decl.h:1917
clang::ProgramPoint
Definition: ProgramPoint.h:58
clang::CallExpr
CallExpr - Represents a function call (C99 6.5.2.2, C++ [expr.call]).
Definition: Expr.h:2812
clang::ento::CheckerContext::blockCount
unsigned blockCount() const
Returns the number of times the current block has been visited along the analyzed path.
Definition: CheckerContext.h:80
clang::ento::SymbolManager
Definition: SymbolManager.h:481
clang::ASTContext::getLangOpts
const LangOptions & getLangOpts() const
Definition: ASTContext.h:761
llvm::IntrusiveRefCntPtr< const ProgramState >
clang::ento::ObjKind::OS
@ OS
Indicates that the tracking object is a descendant of a referenced-counted OSObject,...
clang::ento::CheckerContext::isDifferent
bool isDifferent()
Check if the checker changed the state of the execution; ex: added a new transition or a bug report.
Definition: CheckerContext.h:76