clang  14.0.0git
CheckerContext.h
Go to the documentation of this file.
1 //== CheckerContext.h - Context info for path-sensitive checkers--*- C++ -*--=//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file defines CheckerContext that provides contextual info for
10 // path-sensitive checkers.
11 //
12 //===----------------------------------------------------------------------===//
13 
14 #ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CHECKERCONTEXT_H
15 #define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CHECKERCONTEXT_H
16 
19 
20 namespace clang {
21 namespace ento {
22 
24  ExprEngine &Eng;
25  /// The current exploded(symbolic execution) graph node.
26  ExplodedNode *Pred;
27  /// The flag is true if the (state of the execution) has been modified
28  /// by the checker using this context. For example, a new transition has been
29  /// added or a bug report issued.
30  bool Changed;
31  /// The tagged location, which is used to generate all new nodes.
32  const ProgramPoint Location;
33  NodeBuilder &NB;
34 
35 public:
36  /// If we are post visiting a call, this flag will be set if the
37  /// call was inlined. In all other cases it will be false.
38  const bool wasInlined;
39 
41  ExprEngine &eng,
42  ExplodedNode *pred,
43  const ProgramPoint &loc,
44  bool wasInlined = false)
45  : Eng(eng),
46  Pred(pred),
47  Changed(false),
48  Location(loc),
49  NB(builder),
51  assert(Pred->getState() &&
52  "We should not call the checkers on an empty state.");
53  }
54 
56  return Eng.getAnalysisManager();
57  }
58 
60  return Eng.getConstraintManager();
61  }
62 
64  return Eng.getStoreManager();
65  }
66 
67  /// Returns the previous node in the exploded graph, which includes
68  /// the state of the program before the checker ran. Note, checkers should
69  /// not retain the node in their state since the nodes might get invalidated.
70  ExplodedNode *getPredecessor() { return Pred; }
71  const ProgramStateRef &getState() const { return Pred->getState(); }
72 
73  /// Check if the checker changed the state of the execution; ex: added
74  /// a new transition or a bug report.
75  bool isDifferent() { return Changed; }
76 
77  /// Returns the number of times the current block has been visited
78  /// along the analyzed path.
79  unsigned blockCount() const {
80  return NB.getContext().blockCount();
81  }
82 
84  return Eng.getContext();
85  }
86 
87  const LangOptions &getLangOpts() const {
88  return Eng.getContext().getLangOpts();
89  }
90 
92  return Pred->getLocationContext();
93  }
94 
96  return Pred->getStackFrame();
97  }
98 
99  /// Return true if the current LocationContext has no caller context.
100  bool inTopFrame() const { return getLocationContext()->inTopFrame(); }
101 
103  return Eng.getBugReporter();
104  }
105 
107  return getBugReporter().getSourceManager();
108  }
109 
111 
113  return Eng.getSValBuilder();
114  }
115 
117  return getSValBuilder().getSymbolManager();
118  }
119 
121  return Eng.getStateManager();
122  }
123 
125  return Pred->getLocationContext()->getAnalysisDeclContext();
126  }
127 
128  /// Get the blockID.
129  unsigned getBlockID() const {
130  return NB.getContext().getBlock()->getBlockID();
131  }
132 
133  /// If the given node corresponds to a PostStore program point,
134  /// retrieve the location region as it was uttered in the code.
135  ///
136  /// This utility can be useful for generating extensive diagnostics, for
137  /// example, for finding variables that the given symbol was assigned to.
139  ProgramPoint L = N->getLocation();
140  if (Optional<PostStore> PSL = L.getAs<PostStore>())
141  return reinterpret_cast<const MemRegion*>(PSL->getLocationValue());
142  return nullptr;
143  }
144 
145  /// Get the value of arbitrary expressions at this point in the path.
146  SVal getSVal(const Stmt *S) const {
147  return Pred->getSVal(S);
148  }
149 
150  /// Returns true if the value of \p E is greater than or equal to \p
151  /// Val under unsigned comparison
152  bool isGreaterOrEqual(const Expr *E, unsigned long long Val);
153 
154  /// Returns true if the value of \p E is negative.
155  bool isNegative(const Expr *E);
156 
157  /// Generates a new transition in the program state graph
158  /// (ExplodedGraph). Uses the default CheckerContext predecessor node.
159  ///
160  /// @param State The state of the generated node. If not specified, the state
161  /// will not be changed, but the new node will have the checker's tag.
162  /// @param Tag The tag is used to uniquely identify the creation site. If no
163  /// tag is specified, a default tag, unique to the given checker,
164  /// will be used. Tags are used to prevent states generated at
165  /// different sites from caching out.
167  const ProgramPointTag *Tag = nullptr) {
168  return addTransitionImpl(State ? State : getState(), false, nullptr, Tag);
169  }
170 
171  /// Generates a new transition with the given predecessor.
172  /// Allows checkers to generate a chain of nodes.
173  ///
174  /// @param State The state of the generated node.
175  /// @param Pred The transition will be generated from the specified Pred node
176  /// to the newly generated node.
177  /// @param Tag The tag to uniquely identify the creation site.
179  const ProgramPointTag *Tag = nullptr) {
180  return addTransitionImpl(State, false, Pred, Tag);
181  }
182 
183  /// Generate a sink node. Generating a sink stops exploration of the
184  /// given path. To create a sink node for the purpose of reporting an error,
185  /// checkers should use generateErrorNode() instead.
187  const ProgramPointTag *Tag = nullptr) {
188  return addTransitionImpl(State ? State : getState(), true, Pred, Tag);
189  }
190 
191  /// Add a sink node to the current path of execution, halting analysis.
192  void addSink(ProgramStateRef State = nullptr,
193  const ProgramPointTag *Tag = nullptr) {
194  if (!State)
195  State = getState();
197  }
198 
199  /// Generate a transition to a node that will be used to report
200  /// an error. This node will be a sink. That is, it will stop exploration of
201  /// the given path.
202  ///
203  /// @param State The state of the generated node.
204  /// @param Tag The tag to uniquely identify the creation site. If null,
205  /// the default tag for the checker will be used.
207  const ProgramPointTag *Tag = nullptr) {
208  return generateSink(State, Pred,
209  (Tag ? Tag : Location.getTag()));
210  }
211 
212  /// Generate a transition to a node that will be used to report
213  /// an error. This node will not be a sink. That is, exploration will
214  /// continue along this path.
215  ///
216  /// @param State The state of the generated node.
217  /// @param Tag The tag to uniquely identify the creation site. If null,
218  /// the default tag for the checker will be used.
219  ExplodedNode *
221  const ProgramPointTag *Tag = nullptr) {
222  return addTransition(State, (Tag ? Tag : Location.getTag()));
223  }
224 
225  /// Generate a transition to a node that will be used to report
226  /// an error. This node will not be a sink. That is, exploration will
227  /// continue along this path.
228  ///
229  /// @param State The state of the generated node.
230  /// @param Pred The transition will be generated from the specified Pred node
231  /// to the newly generated node.
232  /// @param Tag The tag to uniquely identify the creation site. If null,
233  /// the default tag for the checker will be used.
234  ExplodedNode *
236  ExplodedNode *Pred,
237  const ProgramPointTag *Tag = nullptr) {
238  return addTransition(State, Pred, (Tag ? Tag : Location.getTag()));
239  }
240 
241  /// Emit the diagnostics report.
242  void emitReport(std::unique_ptr<BugReport> R) {
243  Changed = true;
244  Eng.getBugReporter().emitReport(std::move(R));
245  }
246 
247  /// Produce a program point tag that displays an additional path note
248  /// to the user. This is a lightweight alternative to the
249  /// BugReporterVisitor mechanism: instead of visiting the bug report
250  /// node-by-node to restore the sequence of events that led to discovering
251  /// a bug, you can add notes as you add your transitions.
252  ///
253  /// @param Cb Callback with 'BugReporterContext &, BugReport &' parameters.
254  /// @param IsPrunable Whether the note is prunable. It allows BugReporter
255  /// to omit the note from the report if it would make the displayed
256  /// bug path significantly shorter.
257  const NoteTag *getNoteTag(NoteTag::Callback &&Cb, bool IsPrunable = false) {
258  return Eng.getDataTags().make<NoteTag>(std::move(Cb), IsPrunable);
259  }
260 
261  /// A shorthand version of getNoteTag that doesn't require you to accept
262  /// the 'BugReporterContext' argument when you don't need it.
263  ///
264  /// @param Cb Callback only with 'BugReport &' parameter.
265  /// @param IsPrunable Whether the note is prunable. It allows BugReporter
266  /// to omit the note from the report if it would make the displayed
267  /// bug path significantly shorter.
268  const NoteTag
270  bool IsPrunable = false) {
271  return getNoteTag(
272  [Cb](BugReporterContext &,
273  PathSensitiveBugReport &BR) { return Cb(BR); },
274  IsPrunable);
275  }
276 
277  /// A shorthand version of getNoteTag that doesn't require you to accept
278  /// the arguments when you don't need it.
279  ///
280  /// @param Cb Callback without parameters.
281  /// @param IsPrunable Whether the note is prunable. It allows BugReporter
282  /// to omit the note from the report if it would make the displayed
283  /// bug path significantly shorter.
284  const NoteTag *getNoteTag(std::function<std::string()> &&Cb,
285  bool IsPrunable = false) {
286  return getNoteTag([Cb](BugReporterContext &,
287  PathSensitiveBugReport &) { return Cb(); },
288  IsPrunable);
289  }
290 
291  /// A shorthand version of getNoteTag that accepts a plain note.
292  ///
293  /// @param Note The note.
294  /// @param IsPrunable Whether the note is prunable. It allows BugReporter
295  /// to omit the note from the report if it would make the displayed
296  /// bug path significantly shorter.
297  const NoteTag *getNoteTag(StringRef Note, bool IsPrunable = false) {
298  return getNoteTag(
299  [Note](BugReporterContext &,
300  PathSensitiveBugReport &) { return std::string(Note); },
301  IsPrunable);
302  }
303 
304  /// A shorthand version of getNoteTag that accepts a lambda with stream for
305  /// note.
306  ///
307  /// @param Cb Callback with 'BugReport &' and 'llvm::raw_ostream &'.
308  /// @param IsPrunable Whether the note is prunable. It allows BugReporter
309  /// to omit the note from the report if it would make the displayed
310  /// bug path significantly shorter.
312  std::function<void(PathSensitiveBugReport &BR, llvm::raw_ostream &OS)> &&Cb,
313  bool IsPrunable = false) {
314  return getNoteTag(
315  [Cb](PathSensitiveBugReport &BR) -> std::string {
317  llvm::raw_svector_ostream OS(Str);
318  Cb(BR, OS);
319  return std::string(OS.str());
320  },
321  IsPrunable);
322  }
323 
324  /// Returns the word that should be used to refer to the declaration
325  /// in the report.
326  StringRef getDeclDescription(const Decl *D);
327 
328  /// Get the declaration of the called function (path-sensitive).
329  const FunctionDecl *getCalleeDecl(const CallExpr *CE) const;
330 
331  /// Get the name of the called function (path-sensitive).
332  StringRef getCalleeName(const FunctionDecl *FunDecl) const;
333 
334  /// Get the identifier of the called function (path-sensitive).
335  const IdentifierInfo *getCalleeIdentifier(const CallExpr *CE) const {
336  const FunctionDecl *FunDecl = getCalleeDecl(CE);
337  if (FunDecl)
338  return FunDecl->getIdentifier();
339  else
340  return nullptr;
341  }
342 
343  /// Get the name of the called function (path-sensitive).
344  StringRef getCalleeName(const CallExpr *CE) const {
345  const FunctionDecl *FunDecl = getCalleeDecl(CE);
346  return getCalleeName(FunDecl);
347  }
348 
349  /// Returns true if the callee is an externally-visible function in the
350  /// top-level namespace, such as \c malloc.
351  ///
352  /// If a name is provided, the function must additionally match the given
353  /// name.
354  ///
355  /// Note that this deliberately excludes C++ library functions in the \c std
356  /// namespace, but will include C library functions accessed through the
357  /// \c std namespace. This also does not check if the function is declared
358  /// as 'extern "C"', or if it uses C++ name mangling.
359  static bool isCLibraryFunction(const FunctionDecl *FD,
360  StringRef Name = StringRef());
361 
362  /// Depending on wither the location corresponds to a macro, return
363  /// either the macro name or the token spelling.
364  ///
365  /// This could be useful when checkers' logic depends on whether a function
366  /// is called with a given macro argument. For example:
367  /// s = socket(AF_INET,..)
368  /// If AF_INET is a macro, the result should be treated as a source of taint.
369  ///
370  /// \sa clang::Lexer::getSpelling(), clang::Lexer::getImmediateMacroName().
372 
373 private:
374  ExplodedNode *addTransitionImpl(ProgramStateRef State,
375  bool MarkAsSink,
376  ExplodedNode *P = nullptr,
377  const ProgramPointTag *Tag = nullptr) {
378  // The analyzer may stop exploring if it sees a state it has previously
379  // visited ("cache out"). The early return here is a defensive check to
380  // prevent accidental caching out by checker API clients. Unless there is a
381  // tag or the client checker has requested that the generated node be
382  // marked as a sink, we assume that a client requesting a transition to a
383  // state that is the same as the predecessor state has made a mistake. We
384  // return the predecessor rather than cache out.
385  //
386  // TODO: We could potentially change the return to an assertion to alert
387  // clients to their mistake, but several checkers (including
388  // DereferenceChecker, CallAndMessageChecker, and DynamicTypePropagation)
389  // rely upon the defensive behavior and would need to be updated.
390  if (!State || (State == Pred->getState() && !Tag && !MarkAsSink))
391  return Pred;
392 
393  Changed = true;
394  const ProgramPoint &LocalLoc = (Tag ? Location.withTag(Tag) : Location);
395  if (!P)
396  P = Pred;
397 
399  if (MarkAsSink)
400  node = NB.generateSink(LocalLoc, State, P);
401  else
402  node = NB.generateNode(LocalLoc, State, P);
403  return node;
404  }
405 };
406 
407 } // end GR namespace
408 
409 } // end clang namespace
410 
411 #endif
clang::ento::CheckerContext::getNoteTag
const NoteTag * getNoteTag(NoteTag::Callback &&Cb, bool IsPrunable=false)
Produce a program point tag that displays an additional path note to the user.
Definition: CheckerContext.h:257
clang::ento::CheckerContext::getCalleeName
StringRef getCalleeName(const CallExpr *CE) const
Get the name of the called function (path-sensitive).
Definition: CheckerContext.h:344
clang::ento::ExprEngine::getStateManager
ProgramStateManager & getStateManager()
Definition: ExprEngine.h:415
clang::ProgramPoint::withTag
ProgramPoint withTag(const ProgramPointTag *tag) const
Create a new ProgramPoint object that is the same as the original except for using the specified tag ...
Definition: ProgramPoint.h:132
clang::ento::ExplodedNode::getLocationContext
const LocationContext * getLocationContext() const
Definition: ExplodedGraph.h:146
clang::LocationContext
It wraps the AnalysisDeclContext to represent both the call stack with the help of StackFrameContext ...
Definition: AnalysisDeclContext.h:215
string
string(SUBSTRING ${CMAKE_CURRENT_BINARY_DIR} 0 ${PATH_LIB_START} PATH_HEAD) string(SUBSTRING $
Definition: CMakeLists.txt:22
clang::ento::CheckerContext::getDeclDescription
StringRef getDeclDescription(const Decl *D)
Returns the word that should be used to refer to the declaration in the report.
Definition: CheckerContext.cpp:40
clang::ento::CheckerContext::getNoteTag
const NoteTag * getNoteTag(StringRef Note, bool IsPrunable=false)
A shorthand version of getNoteTag that accepts a plain note.
Definition: CheckerContext.h:297
clang::ento::ConstraintManager
Definition: ConstraintManager.h:77
clang::ento::ExprEngine::getDataTags
DataTag::Factory & getDataTags()
Definition: ExprEngine.h:431
clang::ProgramPointTag
ProgramPoints can be "tagged" as representing points specific to a given analysis entity.
Definition: ProgramPoint.h:39
clang::SourceLocation
Encodes a location in the source.
Definition: SourceLocation.h:86
clang::ento::ExprEngine::getContext
ASTContext & getContext() const
getContext - Return the ASTContext associated with this analysis.
Definition: ExprEngine.h:206
clang::ento::CheckerContext::getLocationContext
const LocationContext * getLocationContext() const
Definition: CheckerContext.h:91
clang::CFGBlock::getBlockID
unsigned getBlockID() const
Definition: CFG.h:1074
clang::ento::CheckerContext::getCalleeDecl
const FunctionDecl * getCalleeDecl(const CallExpr *CE) const
Get the declaration of the called function (path-sensitive).
Definition: CheckerContext.cpp:21
clang::AnalysisDeclContext
AnalysisDeclContext contains the context data for the function, method or block under analysis.
Definition: AnalysisDeclContext.h:72
clang::ento::ExplodedNode::getStackFrame
const StackFrameContext * getStackFrame() const
Definition: ExplodedGraph.h:150
clang::ento::CheckerContext::generateNonFatalErrorNode
ExplodedNode * generateNonFatalErrorNode(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generate a transition to a node that will be used to report an error.
Definition: CheckerContext.h:220
clang::ento::ExplodedNode
Definition: ExplodedGraph.h:65
clang::ento::CheckerContext::getStoreManager
StoreManager & getStoreManager()
Definition: CheckerContext.h:63
clang::ento::CheckerContext::getNoteTag
const NoteTag * getNoteTag(std::function< std::string()> &&Cb, bool IsPrunable=false)
A shorthand version of getNoteTag that doesn't require you to accept the arguments when you don't nee...
Definition: CheckerContext.h:284
clang::ento::CheckerContext::addSink
void addSink(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Add a sink node to the current path of execution, halting analysis.
Definition: CheckerContext.h:192
clang::ento::CheckerContext::getLocationRegionIfPostStore
static const MemRegion * getLocationRegionIfPostStore(const ExplodedNode *N)
If the given node corresponds to a PostStore program point, retrieve the location region as it was ut...
Definition: CheckerContext.h:138
llvm::Optional
Definition: LLVM.h:40
clang::ento::CheckerContext::isGreaterOrEqual
bool isGreaterOrEqual(const Expr *E, unsigned long long Val)
Returns true if the value of E is greater than or equal to Val under unsigned comparison.
Definition: CheckerContext.cpp:126
clang::StackFrameContext
It represents a stack frame of the call stack (based on CallEvent).
Definition: AnalysisDeclContext.h:295
clang::ento::CheckerContext::getCurrentAnalysisDeclContext
AnalysisDeclContext * getCurrentAnalysisDeclContext() const
Definition: CheckerContext.h:124
clang::ento::CheckerContext::generateErrorNode
ExplodedNode * generateErrorNode(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generate a transition to a node that will be used to report an error.
Definition: CheckerContext.h:206
clang::ento::CheckerContext::getState
const ProgramStateRef & getState() const
Definition: CheckerContext.h:71
clang::ento::CheckerContext::getPreprocessor
Preprocessor & getPreprocessor()
Definition: CheckerContext.h:110
clang::ento::StoreManager
Definition: Store.h:53
clang::SourceManager
This class handles loading and caching of source files into memory.
Definition: SourceManager.h:626
clang::ento::MemRegion
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:94
clang::ento::CheckerContext::getCalleeIdentifier
const IdentifierInfo * getCalleeIdentifier(const CallExpr *CE) const
Get the identifier of the called function (path-sensitive).
Definition: CheckerContext.h:335
clang::ento::ExplodedNode::getState
const ProgramStateRef & getState() const
Definition: ExplodedGraph.h:169
clang::ento::NodeBuilder
Definition: CoreEngine.h:237
clang::LocationContext::getAnalysisDeclContext
AnalysisDeclContext * getAnalysisDeclContext() const
Definition: AnalysisDeclContext.h:241
clang::ento::NodeBuilder::generateSink
ExplodedNode * generateSink(const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred)
Generates a sink in the ExplodedGraph.
Definition: CoreEngine.h:301
clang::ento::BugReporter::emitReport
virtual void emitReport(std::unique_ptr< BugReport > R)
Add the given report to the set of reports tracked by BugReporter.
Definition: BugReporter.cpp:2897
clang::ento::BugReporter::getPreprocessor
Preprocessor & getPreprocessor()
Definition: BugReporter.h:622
clang::ento::DataTag::Factory::make
const DataTagType * make(Args &&... ConstructorArgs)
Definition: BugReporter.h:750
clang::LocationContext::inTopFrame
virtual bool inTopFrame() const
Definition: AnalysisDeclContext.cpp:473
clang::ento::CheckerContext::getAnalysisManager
AnalysisManager & getAnalysisManager()
Definition: CheckerContext.h:55
clang::ASTContext
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:212
clang::ProgramPoint::getAs
Optional< T > getAs() const
Convert to the specified ProgramPoint type, returning None if this ProgramPoint is not of the desired...
Definition: ProgramPoint.h:151
clang::ento::CheckerContext::getCalleeName
StringRef getCalleeName(const FunctionDecl *FunDecl) const
Get the name of the called function (path-sensitive).
Definition: CheckerContext.cpp:31
clang::ProgramPoint::getTag
const ProgramPointTag * getTag() const
Definition: ProgramPoint.h:177
clang::PostStore
Represents a program point after a store evaluation.
Definition: ProgramPoint.h:431
clang::ento::CheckerContext::getSymbolManager
SymbolManager & getSymbolManager()
Definition: CheckerContext.h:116
clang::ento::CheckerContext::getNoteTag
const NoteTag * getNoteTag(std::function< void(PathSensitiveBugReport &BR, llvm::raw_ostream &OS)> &&Cb, bool IsPrunable=false)
A shorthand version of getNoteTag that accepts a lambda with stream for note.
Definition: CheckerContext.h:311
clang::ento::CheckerContext::addTransition
ExplodedNode * addTransition(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generates a new transition in the program state graph (ExplodedGraph).
Definition: CheckerContext.h:166
llvm::SmallString< 128 >
clang::ento::CheckerContext::emitReport
void emitReport(std::unique_ptr< BugReport > R)
Emit the diagnostics report.
Definition: CheckerContext.h:242
clang::ento::BugReporterContext
Definition: BugReporter.h:703
clang::ento::CheckerContext::inTopFrame
bool inTopFrame() const
Return true if the current LocationContext has no caller context.
Definition: CheckerContext.h:100
clang::ento::BugReporter
BugReporter is a utility class for generating PathDiagnostics for analysis.
Definition: BugReporter.h:587
clang::ento::NodeBuilderContext::blockCount
unsigned blockCount() const
Returns the number of times the current basic block has been visited on the exploded graph path.
Definition: CoreEngine.h:221
clang::ento::CheckerContext::getMacroNameOrSpelling
StringRef getMacroNameOrSpelling(SourceLocation &Loc)
Depending on wither the location corresponds to a macro, return either the macro name or the token sp...
Definition: CheckerContext.cpp:95
clang::ento::CheckerContext::getStateManager
ProgramStateManager & getStateManager()
Definition: CheckerContext.h:120
clang::ento::CheckerContext::getSourceManager
const SourceManager & getSourceManager()
Definition: CheckerContext.h:106
clang::ento::CheckerContext::getLangOpts
const LangOptions & getLangOpts() const
Definition: CheckerContext.h:87
clang::ento::Loc
Definition: SVals.h:327
clang::ento::CheckerContext::getSValBuilder
SValBuilder & getSValBuilder()
Definition: CheckerContext.h:112
clang::ento::CheckerContext::getPredecessor
ExplodedNode * getPredecessor()
Returns the previous node in the exploded graph, which includes the state of the program before the c...
Definition: CheckerContext.h:70
clang::ento::ExprEngine::getConstraintManager
ConstraintManager & getConstraintManager()
Definition: ExprEngine.h:419
clang::ento::SValBuilder
Definition: SValBuilder.h:53
clang::ento::NodeBuilder::getContext
const NodeBuilderContext & getContext()
Definition: CoreEngine.h:327
clang::ento::CheckerContext::getNoteTag
const NoteTag * getNoteTag(std::function< std::string(PathSensitiveBugReport &)> &&Cb, bool IsPrunable=false)
A shorthand version of getNoteTag that doesn't require you to accept the 'BugReporterContext' argumen...
Definition: CheckerContext.h:269
P
StringRef P
Definition: ASTMatchersInternal.cpp:563
clang::ento::ProgramStateManager
Definition: ProgramState.h:463
clang::ento::BugReporter::getSourceManager
const SourceManager & getSourceManager()
Definition: BugReporter.h:618
clang::ento::CheckerContext::getASTContext
ASTContext & getASTContext()
Definition: CheckerContext.h:83
false
#define false
Definition: stdbool.h:17
clang::NamedDecl::getIdentifier
IdentifierInfo * getIdentifier() const
Get the identifier that names this declaration, if there is one.
Definition: Decl.h:270
clang::Decl
Decl - This represents one declaration (or definition), e.g.
Definition: DeclBase.h:89
State
LineState State
Definition: UnwrappedLineFormatter.cpp:987
clang::ento::ExprEngine::getSValBuilder
SValBuilder & getSValBuilder()
Definition: ExprEngine.h:218
clang::ento::ExprEngine::getBugReporter
BugReporter & getBugReporter()
Definition: ExprEngine.h:220
clang::ento::AnalysisManager
Definition: AnalysisManager.h:31
clang::IdentifierInfo
One of these records is kept for each identifier that is lexed.
Definition: IdentifierTable.h:84
clang::ento::ExprEngine::getAnalysisManager
AnalysisManager & getAnalysisManager()
Definition: ExprEngine.h:208
clang::ento::CheckerContext::isCLibraryFunction
static bool isCLibraryFunction(const FunctionDecl *FD, StringRef Name=StringRef())
Returns true if the callee is an externally-visible function in the top-level namespace,...
Definition: CheckerContext.cpp:48
clang::LangOptions
Keeps track of the various options that can be enabled, which controls the dialect of C or C++ that i...
Definition: LangOptions.h:58
clang::ento::ExprEngine
Definition: ExprEngine.h:127
clang::ento::CheckerContext::addTransition
ExplodedNode * addTransition(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
Generates a new transition with the given predecessor.
Definition: CheckerContext.h:178
clang::ento::PathSensitiveBugReport
Definition: BugReporter.h:291
ExprEngine.h
clang::ento::CheckerContext::getBugReporter
BugReporter & getBugReporter()
Definition: CheckerContext.h:102
clang::ento::ExprEngine::getStoreManager
StoreManager & getStoreManager()
Definition: ExprEngine.h:417
clang::ento::CheckerContext::isNegative
bool isNegative(const Expr *E)
Returns true if the value of E is negative.
Definition: CheckerContext.cpp:131
clang::ento::CheckerContext::generateNonFatalErrorNode
ExplodedNode * generateNonFatalErrorNode(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
Generate a transition to a node that will be used to report an error.
Definition: CheckerContext.h:235
clang::ento::CheckerContext::getStackFrame
const StackFrameContext * getStackFrame() const
Definition: CheckerContext.h:95
clang
Definition: CalledOnceCheck.h:17
clang::ento::ExplodedNode::getLocation
ProgramPoint getLocation() const
getLocation - Returns the edge associated with the given node.
Definition: ExplodedGraph.h:144
clang::Stmt
Stmt - This represents one statement.
Definition: Stmt.h:69
clang::ento::NodeBuilder::generateNode
ExplodedNode * generateNode(const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred)
Generates a node in the ExplodedGraph.
Definition: CoreEngine.h:290
clang::ento::CheckerContext::generateSink
ExplodedNode * generateSink(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
Generate a sink node.
Definition: CheckerContext.h:186
clang::ento::NodeBuilderContext::getBlock
const CFGBlock * getBlock() const
Return the CFGBlock associated with this builder.
Definition: CoreEngine.h:217
clang::ento::CheckerContext::getBlockID
unsigned getBlockID() const
Get the blockID.
Definition: CheckerContext.h:129
clang::ento::ExplodedNode::getSVal
SVal getSVal(const Stmt *S) const
Get the value of an arbitrary expression at this node.
Definition: ExplodedGraph.h:177
clang::ento::SValBuilder::getSymbolManager
SymbolManager & getSymbolManager()
Definition: SValBuilder.h:184
clang::ento::CheckerContext
Definition: CheckerContext.h:23
clang::ento::CheckerContext::CheckerContext
CheckerContext(NodeBuilder &builder, ExprEngine &eng, ExplodedNode *pred, const ProgramPoint &loc, bool wasInlined=false)
Definition: CheckerContext.h:40
clang::ento::SVal
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
Definition: SVals.h:75
clang::transformer::node
RangeSelector node(std::string ID)
Selects a node, including trailing semicolon, if any (for declarations and non-expression statements)...
Definition: RangeSelector.cpp:141
ProgramStateTrait.h
clang::Expr
This represents one expression.
Definition: Expr.h:109
clang::ento::CheckerContext::getConstraintManager
ConstraintManager & getConstraintManager()
Definition: CheckerContext.h:59
clang::Preprocessor
Engages in a tight little dance with the lexer to efficiently preprocess tokens.
Definition: Preprocessor.h:130
clang::ento::CheckerContext::wasInlined
const bool wasInlined
If we are post visiting a call, this flag will be set if the call was inlined.
Definition: CheckerContext.h:38
clang::ento::CheckerContext::getSVal
SVal getSVal(const Stmt *S) const
Get the value of arbitrary expressions at this point in the path.
Definition: CheckerContext.h:146
clang::ento::NoteTag
The tag upon which the TagVisitor reacts.
Definition: BugReporter.h:765
clang::ento::NoteTag::Callback
std::function< std::string(BugReporterContext &, PathSensitiveBugReport &)> Callback
Definition: BugReporter.h:768
clang::FunctionDecl
Represents a function declaration or definition.
Definition: Decl.h:1857
clang::ProgramPoint
Definition: ProgramPoint.h:59
clang::CallExpr
CallExpr - Represents a function call (C99 6.5.2.2, C++ [expr.call]).
Definition: Expr.h:2795
clang::ento::CheckerContext::blockCount
unsigned blockCount() const
Returns the number of times the current block has been visited along the analyzed path.
Definition: CheckerContext.h:79
clang::ento::SymbolManager
Definition: SymbolManager.h:417
clang::ASTContext::getLangOpts
const LangOptions & getLangOpts() const
Definition: ASTContext.h:765
llvm::IntrusiveRefCntPtr< const ProgramState >
clang::ento::ObjKind::OS
@ OS
Indicates that the tracking object is a descendant of a referenced-counted OSObject,...
clang::ento::CheckerContext::isDifferent
bool isDifferent()
Check if the checker changed the state of the execution; ex: added a new transition or a bug report.
Definition: CheckerContext.h:75