clang  16.0.0git
CheckerContext.h
Go to the documentation of this file.
1 //== CheckerContext.h - Context info for path-sensitive checkers--*- C++ -*--=//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file defines CheckerContext that provides contextual info for
10 // path-sensitive checkers.
11 //
12 //===----------------------------------------------------------------------===//
13 
14 #ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CHECKERCONTEXT_H
15 #define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CHECKERCONTEXT_H
16 
19 
20 namespace clang {
21 namespace ento {
22 
24  ExprEngine &Eng;
25  /// The current exploded(symbolic execution) graph node.
26  ExplodedNode *Pred;
27  /// The flag is true if the (state of the execution) has been modified
28  /// by the checker using this context. For example, a new transition has been
29  /// added or a bug report issued.
30  bool Changed;
31  /// The tagged location, which is used to generate all new nodes.
32  const ProgramPoint Location;
33  NodeBuilder &NB;
34 
35 public:
36  /// If we are post visiting a call, this flag will be set if the
37  /// call was inlined. In all other cases it will be false.
38  const bool wasInlined;
39 
41  ExprEngine &eng,
42  ExplodedNode *pred,
43  const ProgramPoint &loc,
44  bool wasInlined = false)
45  : Eng(eng),
46  Pred(pred),
47  Changed(false),
48  Location(loc),
49  NB(builder),
51  assert(Pred->getState() &&
52  "We should not call the checkers on an empty state.");
53  }
54 
56  return Eng.getAnalysisManager();
57  }
58 
60  return Eng.getConstraintManager();
61  }
62 
64  return Eng.getStoreManager();
65  }
66 
67  /// Returns the previous node in the exploded graph, which includes
68  /// the state of the program before the checker ran. Note, checkers should
69  /// not retain the node in their state since the nodes might get invalidated.
70  ExplodedNode *getPredecessor() { return Pred; }
71  const ProgramStateRef &getState() const { return Pred->getState(); }
72 
73  /// Check if the checker changed the state of the execution; ex: added
74  /// a new transition or a bug report.
75  bool isDifferent() { return Changed; }
76 
77  /// Returns the number of times the current block has been visited
78  /// along the analyzed path.
79  unsigned blockCount() const {
80  return NB.getContext().blockCount();
81  }
82 
84  return Eng.getContext();
85  }
86 
87  const ASTContext &getASTContext() const { return Eng.getContext(); }
88 
89  const LangOptions &getLangOpts() const {
90  return Eng.getContext().getLangOpts();
91  }
92 
94  return Pred->getLocationContext();
95  }
96 
98  return Pred->getStackFrame();
99  }
100 
101  /// Return true if the current LocationContext has no caller context.
102  bool inTopFrame() const { return getLocationContext()->inTopFrame(); }
103 
105  return Eng.getBugReporter();
106  }
107 
109  return getBugReporter().getSourceManager();
110  }
111 
113 
115  return Eng.getSValBuilder();
116  }
117 
119  return getSValBuilder().getSymbolManager();
120  }
121 
123  return Eng.getStateManager();
124  }
125 
127  return Pred->getLocationContext()->getAnalysisDeclContext();
128  }
129 
130  /// Get the blockID.
131  unsigned getBlockID() const {
132  return NB.getContext().getBlock()->getBlockID();
133  }
134 
135  /// If the given node corresponds to a PostStore program point,
136  /// retrieve the location region as it was uttered in the code.
137  ///
138  /// This utility can be useful for generating extensive diagnostics, for
139  /// example, for finding variables that the given symbol was assigned to.
141  ProgramPoint L = N->getLocation();
142  if (Optional<PostStore> PSL = L.getAs<PostStore>())
143  return reinterpret_cast<const MemRegion*>(PSL->getLocationValue());
144  return nullptr;
145  }
146 
147  /// Get the value of arbitrary expressions at this point in the path.
148  SVal getSVal(const Stmt *S) const {
149  return Pred->getSVal(S);
150  }
151 
152  /// Returns true if the value of \p E is greater than or equal to \p
153  /// Val under unsigned comparison
154  bool isGreaterOrEqual(const Expr *E, unsigned long long Val);
155 
156  /// Returns true if the value of \p E is negative.
157  bool isNegative(const Expr *E);
158 
159  /// Generates a new transition in the program state graph
160  /// (ExplodedGraph). Uses the default CheckerContext predecessor node.
161  ///
162  /// @param State The state of the generated node. If not specified, the state
163  /// will not be changed, but the new node will have the checker's tag.
164  /// @param Tag The tag is used to uniquely identify the creation site. If no
165  /// tag is specified, a default tag, unique to the given checker,
166  /// will be used. Tags are used to prevent states generated at
167  /// different sites from caching out.
169  const ProgramPointTag *Tag = nullptr) {
170  return addTransitionImpl(State ? State : getState(), false, nullptr, Tag);
171  }
172 
173  /// Generates a new transition with the given predecessor.
174  /// Allows checkers to generate a chain of nodes.
175  ///
176  /// @param State The state of the generated node.
177  /// @param Pred The transition will be generated from the specified Pred node
178  /// to the newly generated node.
179  /// @param Tag The tag to uniquely identify the creation site.
181  const ProgramPointTag *Tag = nullptr) {
182  return addTransitionImpl(State, false, Pred, Tag);
183  }
184 
185  /// Generate a sink node. Generating a sink stops exploration of the
186  /// given path. To create a sink node for the purpose of reporting an error,
187  /// checkers should use generateErrorNode() instead.
189  const ProgramPointTag *Tag = nullptr) {
190  return addTransitionImpl(State ? State : getState(), true, Pred, Tag);
191  }
192 
193  /// Add a sink node to the current path of execution, halting analysis.
194  void addSink(ProgramStateRef State = nullptr,
195  const ProgramPointTag *Tag = nullptr) {
196  if (!State)
197  State = getState();
199  }
200 
201  /// Generate a transition to a node that will be used to report
202  /// an error. This node will be a sink. That is, it will stop exploration of
203  /// the given path.
204  ///
205  /// @param State The state of the generated node.
206  /// @param Tag The tag to uniquely identify the creation site. If null,
207  /// the default tag for the checker will be used.
209  const ProgramPointTag *Tag = nullptr) {
210  return generateSink(State, Pred,
211  (Tag ? Tag : Location.getTag()));
212  }
213 
214  /// Generate a transition to a node that will be used to report
215  /// an error. This node will not be a sink. That is, exploration will
216  /// continue along this path.
217  ///
218  /// @param State The state of the generated node.
219  /// @param Tag The tag to uniquely identify the creation site. If null,
220  /// the default tag for the checker will be used.
221  ExplodedNode *
223  const ProgramPointTag *Tag = nullptr) {
224  return addTransition(State, (Tag ? Tag : Location.getTag()));
225  }
226 
227  /// Generate a transition to a node that will be used to report
228  /// an error. This node will not be a sink. That is, exploration will
229  /// continue along this path.
230  ///
231  /// @param State The state of the generated node.
232  /// @param Pred The transition will be generated from the specified Pred node
233  /// to the newly generated node.
234  /// @param Tag The tag to uniquely identify the creation site. If null,
235  /// the default tag for the checker will be used.
236  ExplodedNode *
238  ExplodedNode *Pred,
239  const ProgramPointTag *Tag = nullptr) {
240  return addTransition(State, Pred, (Tag ? Tag : Location.getTag()));
241  }
242 
243  /// Emit the diagnostics report.
244  void emitReport(std::unique_ptr<BugReport> R) {
245  Changed = true;
246  Eng.getBugReporter().emitReport(std::move(R));
247  }
248 
249  /// Produce a program point tag that displays an additional path note
250  /// to the user. This is a lightweight alternative to the
251  /// BugReporterVisitor mechanism: instead of visiting the bug report
252  /// node-by-node to restore the sequence of events that led to discovering
253  /// a bug, you can add notes as you add your transitions.
254  ///
255  /// @param Cb Callback with 'BugReporterContext &, BugReport &' parameters.
256  /// @param IsPrunable Whether the note is prunable. It allows BugReporter
257  /// to omit the note from the report if it would make the displayed
258  /// bug path significantly shorter.
259  LLVM_ATTRIBUTE_RETURNS_NONNULL
260  const NoteTag *getNoteTag(NoteTag::Callback &&Cb, bool IsPrunable = false) {
261  return Eng.getDataTags().make<NoteTag>(std::move(Cb), IsPrunable);
262  }
263 
264  /// A shorthand version of getNoteTag that doesn't require you to accept
265  /// the 'BugReporterContext' argument when you don't need it.
266  ///
267  /// @param Cb Callback only with 'BugReport &' parameter.
268  /// @param IsPrunable Whether the note is prunable. It allows BugReporter
269  /// to omit the note from the report if it would make the displayed
270  /// bug path significantly shorter.
271  const NoteTag
273  bool IsPrunable = false) {
274  return getNoteTag(
275  [Cb](BugReporterContext &,
276  PathSensitiveBugReport &BR) { return Cb(BR); },
277  IsPrunable);
278  }
279 
280  /// A shorthand version of getNoteTag that doesn't require you to accept
281  /// the arguments when you don't need it.
282  ///
283  /// @param Cb Callback without parameters.
284  /// @param IsPrunable Whether the note is prunable. It allows BugReporter
285  /// to omit the note from the report if it would make the displayed
286  /// bug path significantly shorter.
287  const NoteTag *getNoteTag(std::function<std::string()> &&Cb,
288  bool IsPrunable = false) {
289  return getNoteTag([Cb](BugReporterContext &,
290  PathSensitiveBugReport &) { return Cb(); },
291  IsPrunable);
292  }
293 
294  /// A shorthand version of getNoteTag that accepts a plain note.
295  ///
296  /// @param Note The note.
297  /// @param IsPrunable Whether the note is prunable. It allows BugReporter
298  /// to omit the note from the report if it would make the displayed
299  /// bug path significantly shorter.
300  const NoteTag *getNoteTag(StringRef Note, bool IsPrunable = false) {
301  return getNoteTag(
302  [Note](BugReporterContext &,
303  PathSensitiveBugReport &) { return std::string(Note); },
304  IsPrunable);
305  }
306 
307  /// A shorthand version of getNoteTag that accepts a lambda with stream for
308  /// note.
309  ///
310  /// @param Cb Callback with 'BugReport &' and 'llvm::raw_ostream &'.
311  /// @param IsPrunable Whether the note is prunable. It allows BugReporter
312  /// to omit the note from the report if it would make the displayed
313  /// bug path significantly shorter.
315  std::function<void(PathSensitiveBugReport &BR, llvm::raw_ostream &OS)> &&Cb,
316  bool IsPrunable = false) {
317  return getNoteTag(
318  [Cb](PathSensitiveBugReport &BR) -> std::string {
320  llvm::raw_svector_ostream OS(Str);
321  Cb(BR, OS);
322  return std::string(OS.str());
323  },
324  IsPrunable);
325  }
326 
327  /// Returns the word that should be used to refer to the declaration
328  /// in the report.
329  StringRef getDeclDescription(const Decl *D);
330 
331  /// Get the declaration of the called function (path-sensitive).
332  const FunctionDecl *getCalleeDecl(const CallExpr *CE) const;
333 
334  /// Get the name of the called function (path-sensitive).
335  StringRef getCalleeName(const FunctionDecl *FunDecl) const;
336 
337  /// Get the identifier of the called function (path-sensitive).
338  const IdentifierInfo *getCalleeIdentifier(const CallExpr *CE) const {
339  const FunctionDecl *FunDecl = getCalleeDecl(CE);
340  if (FunDecl)
341  return FunDecl->getIdentifier();
342  else
343  return nullptr;
344  }
345 
346  /// Get the name of the called function (path-sensitive).
347  StringRef getCalleeName(const CallExpr *CE) const {
348  const FunctionDecl *FunDecl = getCalleeDecl(CE);
349  return getCalleeName(FunDecl);
350  }
351 
352  /// Returns true if the callee is an externally-visible function in the
353  /// top-level namespace, such as \c malloc.
354  ///
355  /// If a name is provided, the function must additionally match the given
356  /// name.
357  ///
358  /// Note that this deliberately excludes C++ library functions in the \c std
359  /// namespace, but will include C library functions accessed through the
360  /// \c std namespace. This also does not check if the function is declared
361  /// as 'extern "C"', or if it uses C++ name mangling.
362  static bool isCLibraryFunction(const FunctionDecl *FD,
363  StringRef Name = StringRef());
364 
365  /// Depending on wither the location corresponds to a macro, return
366  /// either the macro name or the token spelling.
367  ///
368  /// This could be useful when checkers' logic depends on whether a function
369  /// is called with a given macro argument. For example:
370  /// s = socket(AF_INET,..)
371  /// If AF_INET is a macro, the result should be treated as a source of taint.
372  ///
373  /// \sa clang::Lexer::getSpelling(), clang::Lexer::getImmediateMacroName().
375 
376 private:
377  ExplodedNode *addTransitionImpl(ProgramStateRef State,
378  bool MarkAsSink,
379  ExplodedNode *P = nullptr,
380  const ProgramPointTag *Tag = nullptr) {
381  // The analyzer may stop exploring if it sees a state it has previously
382  // visited ("cache out"). The early return here is a defensive check to
383  // prevent accidental caching out by checker API clients. Unless there is a
384  // tag or the client checker has requested that the generated node be
385  // marked as a sink, we assume that a client requesting a transition to a
386  // state that is the same as the predecessor state has made a mistake. We
387  // return the predecessor rather than cache out.
388  //
389  // TODO: We could potentially change the return to an assertion to alert
390  // clients to their mistake, but several checkers (including
391  // DereferenceChecker, CallAndMessageChecker, and DynamicTypePropagation)
392  // rely upon the defensive behavior and would need to be updated.
393  if (!State || (State == Pred->getState() && !Tag && !MarkAsSink))
394  return Pred;
395 
396  Changed = true;
397  const ProgramPoint &LocalLoc = (Tag ? Location.withTag(Tag) : Location);
398  if (!P)
399  P = Pred;
400 
402  if (MarkAsSink)
403  node = NB.generateSink(LocalLoc, State, P);
404  else
405  node = NB.generateNode(LocalLoc, State, P);
406  return node;
407  }
408 };
409 
410 } // end GR namespace
411 
412 } // end clang namespace
413 
414 #endif
clang::ento::CheckerContext::getCalleeName
StringRef getCalleeName(const CallExpr *CE) const
Get the name of the called function (path-sensitive).
Definition: CheckerContext.h:347
clang::ento::ExprEngine::getStateManager
ProgramStateManager & getStateManager()
Definition: ExprEngine.h:417
clang::ProgramPoint::withTag
ProgramPoint withTag(const ProgramPointTag *tag) const
Create a new ProgramPoint object that is the same as the original except for using the specified tag ...
Definition: ProgramPoint.h:131
clang::ento::ExplodedNode::getLocationContext
const LocationContext * getLocationContext() const
Definition: ExplodedGraph.h:146
clang::LocationContext
It wraps the AnalysisDeclContext to represent both the call stack with the help of StackFrameContext ...
Definition: AnalysisDeclContext.h:215
string
string(SUBSTRING ${CMAKE_CURRENT_BINARY_DIR} 0 ${PATH_LIB_START} PATH_HEAD) string(SUBSTRING $
Definition: CMakeLists.txt:22
clang::ento::CheckerContext::getASTContext
const ASTContext & getASTContext() const
Definition: CheckerContext.h:87
clang::ento::CheckerContext::getDeclDescription
StringRef getDeclDescription(const Decl *D)
Returns the word that should be used to refer to the declaration in the report.
Definition: CheckerContext.cpp:40
clang::ento::CheckerContext::getNoteTag
const NoteTag * getNoteTag(StringRef Note, bool IsPrunable=false)
A shorthand version of getNoteTag that accepts a plain note.
Definition: CheckerContext.h:300
clang::ento::ConstraintManager
Definition: ConstraintManager.h:69
clang::ento::ExprEngine::getDataTags
DataTag::Factory & getDataTags()
Definition: ExprEngine.h:433
clang::ProgramPointTag
ProgramPoints can be "tagged" as representing points specific to a given analysis entity.
Definition: ProgramPoint.h:38
clang::SourceLocation
Encodes a location in the source.
Definition: SourceLocation.h:86
clang::ento::ExprEngine::getContext
ASTContext & getContext() const
getContext - Return the ASTContext associated with this analysis.
Definition: ExprEngine.h:203
clang::ento::CheckerContext::getLocationContext
const LocationContext * getLocationContext() const
Definition: CheckerContext.h:93
clang::CFGBlock::getBlockID
unsigned getBlockID() const
Definition: CFG.h:1075
clang::ento::CheckerContext::getCalleeDecl
const FunctionDecl * getCalleeDecl(const CallExpr *CE) const
Get the declaration of the called function (path-sensitive).
Definition: CheckerContext.cpp:21
clang::AnalysisDeclContext
AnalysisDeclContext contains the context data for the function, method or block under analysis.
Definition: AnalysisDeclContext.h:72
clang::ento::ExplodedNode::getStackFrame
const StackFrameContext * getStackFrame() const
Definition: ExplodedGraph.h:150
clang::ento::CheckerContext::generateNonFatalErrorNode
ExplodedNode * generateNonFatalErrorNode(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generate a transition to a node that will be used to report an error.
Definition: CheckerContext.h:222
clang::ento::ExplodedNode
Definition: ExplodedGraph.h:65
clang::ento::CheckerContext::getStoreManager
StoreManager & getStoreManager()
Definition: CheckerContext.h:63
clang::ento::CheckerContext::getNoteTag
const NoteTag * getNoteTag(std::function< std::string()> &&Cb, bool IsPrunable=false)
A shorthand version of getNoteTag that doesn't require you to accept the arguments when you don't nee...
Definition: CheckerContext.h:287
clang::ento::CheckerContext::addSink
void addSink(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Add a sink node to the current path of execution, halting analysis.
Definition: CheckerContext.h:194
clang::ento::CheckerContext::getLocationRegionIfPostStore
static const MemRegion * getLocationRegionIfPostStore(const ExplodedNode *N)
If the given node corresponds to a PostStore program point, retrieve the location region as it was ut...
Definition: CheckerContext.h:140
llvm::Optional
Definition: LLVM.h:40
clang::ento::CheckerContext::isGreaterOrEqual
bool isGreaterOrEqual(const Expr *E, unsigned long long Val)
Returns true if the value of E is greater than or equal to Val under unsigned comparison.
Definition: CheckerContext.cpp:147
clang::StackFrameContext
It represents a stack frame of the call stack (based on CallEvent).
Definition: AnalysisDeclContext.h:299
clang::ento::CheckerContext::getCurrentAnalysisDeclContext
AnalysisDeclContext * getCurrentAnalysisDeclContext() const
Definition: CheckerContext.h:126
clang::ento::CheckerContext::generateErrorNode
ExplodedNode * generateErrorNode(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generate a transition to a node that will be used to report an error.
Definition: CheckerContext.h:208
clang::ento::CheckerContext::getState
const ProgramStateRef & getState() const
Definition: CheckerContext.h:71
clang::ento::CheckerContext::getPreprocessor
Preprocessor & getPreprocessor()
Definition: CheckerContext.h:112
clang::ento::StoreManager
Definition: Store.h:53
clang::SourceManager
This class handles loading and caching of source files into memory.
Definition: SourceManager.h:627
clang::ento::MemRegion
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:95
clang::ento::CheckerContext::getCalleeIdentifier
const IdentifierInfo * getCalleeIdentifier(const CallExpr *CE) const
Get the identifier of the called function (path-sensitive).
Definition: CheckerContext.h:338
clang::ento::ExplodedNode::getState
const ProgramStateRef & getState() const
Definition: ExplodedGraph.h:168
clang::ento::NodeBuilder
Definition: CoreEngine.h:241
clang::ento::NodeBuilder::generateSink
ExplodedNode * generateSink(const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred)
Generates a sink in the ExplodedGraph.
Definition: CoreEngine.h:307
clang::ento::BugReporter::emitReport
virtual void emitReport(std::unique_ptr< BugReport > R)
Add the given report to the set of reports tracked by BugReporter.
Definition: BugReporter.cpp:2897
clang::ento::BugReporter::getPreprocessor
Preprocessor & getPreprocessor()
Definition: BugReporter.h:620
clang::ento::DataTag::Factory::make
const DataTagType * make(Args &&... ConstructorArgs)
Definition: BugReporter.h:748
clang::LocationContext::inTopFrame
virtual bool inTopFrame() const
Definition: AnalysisDeclContext.cpp:473
clang::ento::CheckerContext::getAnalysisManager
AnalysisManager & getAnalysisManager()
Definition: CheckerContext.h:55
clang::ASTContext
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:209
clang::ProgramPoint::getAs
Optional< T > getAs() const
Convert to the specified ProgramPoint type, returning None if this ProgramPoint is not of the desired...
Definition: ProgramPoint.h:150
clang::ento::CheckerContext::getCalleeName
StringRef getCalleeName(const FunctionDecl *FunDecl) const
Get the name of the called function (path-sensitive).
Definition: CheckerContext.cpp:31
clang::ProgramPoint::getTag
const ProgramPointTag * getTag() const
Definition: ProgramPoint.h:176
clang::PostStore
Represents a program point after a store evaluation.
Definition: ProgramPoint.h:430
clang::ento::CheckerContext::getSymbolManager
SymbolManager & getSymbolManager()
Definition: CheckerContext.h:118
clang::ento::CheckerContext::getNoteTag
const NoteTag * getNoteTag(std::function< void(PathSensitiveBugReport &BR, llvm::raw_ostream &OS)> &&Cb, bool IsPrunable=false)
A shorthand version of getNoteTag that accepts a lambda with stream for note.
Definition: CheckerContext.h:314
clang::ento::CheckerContext::addTransition
ExplodedNode * addTransition(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generates a new transition in the program state graph (ExplodedGraph).
Definition: CheckerContext.h:168
llvm::SmallString< 128 >
clang::ento::CheckerContext::emitReport
void emitReport(std::unique_ptr< BugReport > R)
Emit the diagnostics report.
Definition: CheckerContext.h:244
clang::ento::BugReporterContext
Definition: BugReporter.h:701
clang::ento::CheckerContext::inTopFrame
bool inTopFrame() const
Return true if the current LocationContext has no caller context.
Definition: CheckerContext.h:102
clang::ento::BugReporter
BugReporter is a utility class for generating PathDiagnostics for analysis.
Definition: BugReporter.h:585
clang::ento::NodeBuilderContext::blockCount
unsigned blockCount() const
Returns the number of times the current basic block has been visited on the exploded graph path.
Definition: CoreEngine.h:225
clang::ento::CheckerContext::getMacroNameOrSpelling
StringRef getMacroNameOrSpelling(SourceLocation &Loc)
Depending on wither the location corresponds to a macro, return either the macro name or the token sp...
Definition: CheckerContext.cpp:116
clang::ento::CheckerContext::getStateManager
ProgramStateManager & getStateManager()
Definition: CheckerContext.h:122
clang::ento::CheckerContext::getSourceManager
const SourceManager & getSourceManager()
Definition: CheckerContext.h:108
clang::ento::CheckerContext::getLangOpts
const LangOptions & getLangOpts() const
Definition: CheckerContext.h:89
clang::ento::Loc
Definition: SVals.h:282
clang::ento::CheckerContext::getSValBuilder
SValBuilder & getSValBuilder()
Definition: CheckerContext.h:114
clang::ento::CheckerContext::getPredecessor
ExplodedNode * getPredecessor()
Returns the previous node in the exploded graph, which includes the state of the program before the c...
Definition: CheckerContext.h:70
clang::ento::ExprEngine::getConstraintManager
ConstraintManager & getConstraintManager()
Definition: ExprEngine.h:421
clang::ento::SValBuilder
Definition: SValBuilder.h:53
clang::LocationContext::getAnalysisDeclContext
LLVM_ATTRIBUTE_RETURNS_NONNULL AnalysisDeclContext * getAnalysisDeclContext() const
Definition: AnalysisDeclContext.h:244
clang::ento::NodeBuilder::getContext
const NodeBuilderContext & getContext()
Definition: CoreEngine.h:333
clang::ento::CheckerContext::getNoteTag
const NoteTag * getNoteTag(std::function< std::string(PathSensitiveBugReport &)> &&Cb, bool IsPrunable=false)
A shorthand version of getNoteTag that doesn't require you to accept the 'BugReporterContext' argumen...
Definition: CheckerContext.h:272
P
StringRef P
Definition: ASTMatchersInternal.cpp:563
clang::ento::ProgramStateManager
Definition: ProgramState.h:502
clang::ento::BugReporter::getSourceManager
const SourceManager & getSourceManager()
Definition: BugReporter.h:616
clang::ento::CheckerContext::getASTContext
ASTContext & getASTContext()
Definition: CheckerContext.h:83
false
#define false
Definition: stdbool.h:22
clang::NamedDecl::getIdentifier
IdentifierInfo * getIdentifier() const
Get the identifier that names this declaration, if there is one.
Definition: Decl.h:268
clang::Decl
Decl - This represents one declaration (or definition), e.g.
Definition: DeclBase.h:83
State
LineState State
Definition: UnwrappedLineFormatter.cpp:1139
clang::ento::ExprEngine::getSValBuilder
SValBuilder & getSValBuilder()
Definition: ExprEngine.h:215
clang::ento::ExprEngine::getBugReporter
BugReporter & getBugReporter()
Definition: ExprEngine.h:217
clang::ento::AnalysisManager
Definition: AnalysisManager.h:31
clang::IdentifierInfo
One of these records is kept for each identifier that is lexed.
Definition: IdentifierTable.h:85
clang::ento::ExprEngine::getAnalysisManager
AnalysisManager & getAnalysisManager()
Definition: ExprEngine.h:205
clang::ento::CheckerContext::isCLibraryFunction
static bool isCLibraryFunction(const FunctionDecl *FD, StringRef Name=StringRef())
Returns true if the callee is an externally-visible function in the top-level namespace,...
Definition: CheckerContext.cpp:48
clang::LangOptions
Keeps track of the various options that can be enabled, which controls the dialect of C or C++ that i...
Definition: LangOptions.h:78
clang::ento::ExprEngine
Definition: ExprEngine.h:123
clang::ento::CheckerContext::addTransition
ExplodedNode * addTransition(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
Generates a new transition with the given predecessor.
Definition: CheckerContext.h:180
clang::ento::PathSensitiveBugReport
Definition: BugReporter.h:289
ExprEngine.h
clang::ento::CheckerContext::getBugReporter
BugReporter & getBugReporter()
Definition: CheckerContext.h:104
clang::ento::ExprEngine::getStoreManager
StoreManager & getStoreManager()
Definition: ExprEngine.h:419
clang::ento::CheckerContext::isNegative
bool isNegative(const Expr *E)
Returns true if the value of E is negative.
Definition: CheckerContext.cpp:152
clang::ento::CheckerContext::generateNonFatalErrorNode
ExplodedNode * generateNonFatalErrorNode(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
Generate a transition to a node that will be used to report an error.
Definition: CheckerContext.h:237
clang::ento::CheckerContext::getStackFrame
const StackFrameContext * getStackFrame() const
Definition: CheckerContext.h:97
clang
Definition: CalledOnceCheck.h:17
clang::ento::ExplodedNode::getLocation
ProgramPoint getLocation() const
getLocation - Returns the edge associated with the given node.
Definition: ExplodedGraph.h:144
clang::Stmt
Stmt - This represents one statement.
Definition: Stmt.h:70
clang::ento::NodeBuilder::generateNode
ExplodedNode * generateNode(const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred)
Generates a node in the ExplodedGraph.
Definition: CoreEngine.h:294
clang::ento::CheckerContext::generateSink
ExplodedNode * generateSink(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
Generate a sink node.
Definition: CheckerContext.h:188
clang::ento::NodeBuilderContext::getBlock
const CFGBlock * getBlock() const
Return the CFGBlock associated with this builder.
Definition: CoreEngine.h:221
clang::ento::CheckerContext::getBlockID
unsigned getBlockID() const
Get the blockID.
Definition: CheckerContext.h:131
clang::ento::ExplodedNode::getSVal
SVal getSVal(const Stmt *S) const
Get the value of an arbitrary expression at this node.
Definition: ExplodedGraph.h:175
clang::ento::SValBuilder::getSymbolManager
SymbolManager & getSymbolManager()
Definition: SValBuilder.h:152
clang::ento::CheckerContext
Definition: CheckerContext.h:23
clang::ento::CheckerContext::CheckerContext
CheckerContext(NodeBuilder &builder, ExprEngine &eng, ExplodedNode *pred, const ProgramPoint &loc, bool wasInlined=false)
Definition: CheckerContext.h:40
clang::ento::SVal
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
Definition: SVals.h:73
clang::transformer::node
RangeSelector node(std::string ID)
Selects a node, including trailing semicolon, if any (for declarations and non-expression statements)...
Definition: RangeSelector.cpp:141
ProgramStateTrait.h
clang::Expr
This represents one expression.
Definition: Expr.h:109
clang::ento::CheckerContext::getConstraintManager
ConstraintManager & getConstraintManager()
Definition: CheckerContext.h:59
clang::Preprocessor
Engages in a tight little dance with the lexer to efficiently preprocess tokens.
Definition: Preprocessor.h:129
clang::ento::CheckerContext::getNoteTag
const LLVM_ATTRIBUTE_RETURNS_NONNULL NoteTag * getNoteTag(NoteTag::Callback &&Cb, bool IsPrunable=false)
Produce a program point tag that displays an additional path note to the user.
Definition: CheckerContext.h:260
clang::ento::CheckerContext::wasInlined
const bool wasInlined
If we are post visiting a call, this flag will be set if the call was inlined.
Definition: CheckerContext.h:38
clang::ento::CheckerContext::getSVal
SVal getSVal(const Stmt *S) const
Get the value of arbitrary expressions at this point in the path.
Definition: CheckerContext.h:148
clang::ento::NoteTag
The tag upon which the TagVisitor reacts.
Definition: BugReporter.h:763
clang::ento::NoteTag::Callback
std::function< std::string(BugReporterContext &, PathSensitiveBugReport &)> Callback
Definition: BugReporter.h:766
clang::FunctionDecl
Represents a function declaration or definition.
Definition: Decl.h:1877
clang::ProgramPoint
Definition: ProgramPoint.h:58
clang::CallExpr
CallExpr - Represents a function call (C99 6.5.2.2, C++ [expr.call]).
Definition: Expr.h:2801
clang::ento::CheckerContext::blockCount
unsigned blockCount() const
Returns the number of times the current block has been visited along the analyzed path.
Definition: CheckerContext.h:79
clang::ento::SymbolManager
Definition: SymbolManager.h:481
clang::ASTContext::getLangOpts
const LangOptions & getLangOpts() const
Definition: ASTContext.h:790
llvm::IntrusiveRefCntPtr< const ProgramState >
clang::ento::ObjKind::OS
@ OS
Indicates that the tracking object is a descendant of a referenced-counted OSObject,...
clang::ento::CheckerContext::isDifferent
bool isDifferent()
Check if the checker changed the state of the execution; ex: added a new transition or a bug report.
Definition: CheckerContext.h:75