clang  15.0.0git
CheckerContext.h
Go to the documentation of this file.
1 //== CheckerContext.h - Context info for path-sensitive checkers--*- C++ -*--=//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file defines CheckerContext that provides contextual info for
10 // path-sensitive checkers.
11 //
12 //===----------------------------------------------------------------------===//
13 
14 #ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CHECKERCONTEXT_H
15 #define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CHECKERCONTEXT_H
16 
19 
20 namespace clang {
21 namespace ento {
22 
24  ExprEngine &Eng;
25  /// The current exploded(symbolic execution) graph node.
26  ExplodedNode *Pred;
27  /// The flag is true if the (state of the execution) has been modified
28  /// by the checker using this context. For example, a new transition has been
29  /// added or a bug report issued.
30  bool Changed;
31  /// The tagged location, which is used to generate all new nodes.
32  const ProgramPoint Location;
33  NodeBuilder &NB;
34 
35 public:
36  /// If we are post visiting a call, this flag will be set if the
37  /// call was inlined. In all other cases it will be false.
38  const bool wasInlined;
39 
41  ExprEngine &eng,
42  ExplodedNode *pred,
43  const ProgramPoint &loc,
44  bool wasInlined = false)
45  : Eng(eng),
46  Pred(pred),
47  Changed(false),
48  Location(loc),
49  NB(builder),
51  assert(Pred->getState() &&
52  "We should not call the checkers on an empty state.");
53  }
54 
56  return Eng.getAnalysisManager();
57  }
58 
60  return Eng.getConstraintManager();
61  }
62 
64  return Eng.getStoreManager();
65  }
66 
67  /// Returns the previous node in the exploded graph, which includes
68  /// the state of the program before the checker ran. Note, checkers should
69  /// not retain the node in their state since the nodes might get invalidated.
70  ExplodedNode *getPredecessor() { return Pred; }
71  const ProgramStateRef &getState() const { return Pred->getState(); }
72 
73  /// Check if the checker changed the state of the execution; ex: added
74  /// a new transition or a bug report.
75  bool isDifferent() { return Changed; }
76 
77  /// Returns the number of times the current block has been visited
78  /// along the analyzed path.
79  unsigned blockCount() const {
80  return NB.getContext().blockCount();
81  }
82 
84  return Eng.getContext();
85  }
86 
87  const ASTContext &getASTContext() const { return Eng.getContext(); }
88 
89  const LangOptions &getLangOpts() const {
90  return Eng.getContext().getLangOpts();
91  }
92 
94  return Pred->getLocationContext();
95  }
96 
98  return Pred->getStackFrame();
99  }
100 
101  /// Return true if the current LocationContext has no caller context.
102  bool inTopFrame() const { return getLocationContext()->inTopFrame(); }
103 
105  return Eng.getBugReporter();
106  }
107 
109  return getBugReporter().getSourceManager();
110  }
111 
113 
115  return Eng.getSValBuilder();
116  }
117 
119  return getSValBuilder().getSymbolManager();
120  }
121 
123  return Eng.getStateManager();
124  }
125 
127  return Pred->getLocationContext()->getAnalysisDeclContext();
128  }
129 
130  /// Get the blockID.
131  unsigned getBlockID() const {
132  return NB.getContext().getBlock()->getBlockID();
133  }
134 
135  /// If the given node corresponds to a PostStore program point,
136  /// retrieve the location region as it was uttered in the code.
137  ///
138  /// This utility can be useful for generating extensive diagnostics, for
139  /// example, for finding variables that the given symbol was assigned to.
141  ProgramPoint L = N->getLocation();
142  if (Optional<PostStore> PSL = L.getAs<PostStore>())
143  return reinterpret_cast<const MemRegion*>(PSL->getLocationValue());
144  return nullptr;
145  }
146 
147  /// Get the value of arbitrary expressions at this point in the path.
148  SVal getSVal(const Stmt *S) const {
149  return Pred->getSVal(S);
150  }
151 
152  /// Returns true if the value of \p E is greater than or equal to \p
153  /// Val under unsigned comparison
154  bool isGreaterOrEqual(const Expr *E, unsigned long long Val);
155 
156  /// Returns true if the value of \p E is negative.
157  bool isNegative(const Expr *E);
158 
159  /// Generates a new transition in the program state graph
160  /// (ExplodedGraph). Uses the default CheckerContext predecessor node.
161  ///
162  /// @param State The state of the generated node. If not specified, the state
163  /// will not be changed, but the new node will have the checker's tag.
164  /// @param Tag The tag is used to uniquely identify the creation site. If no
165  /// tag is specified, a default tag, unique to the given checker,
166  /// will be used. Tags are used to prevent states generated at
167  /// different sites from caching out.
169  const ProgramPointTag *Tag = nullptr) {
170  return addTransitionImpl(State ? State : getState(), false, nullptr, Tag);
171  }
172 
173  /// Generates a new transition with the given predecessor.
174  /// Allows checkers to generate a chain of nodes.
175  ///
176  /// @param State The state of the generated node.
177  /// @param Pred The transition will be generated from the specified Pred node
178  /// to the newly generated node.
179  /// @param Tag The tag to uniquely identify the creation site.
181  const ProgramPointTag *Tag = nullptr) {
182  return addTransitionImpl(State, false, Pred, Tag);
183  }
184 
185  /// Generate a sink node. Generating a sink stops exploration of the
186  /// given path. To create a sink node for the purpose of reporting an error,
187  /// checkers should use generateErrorNode() instead.
189  const ProgramPointTag *Tag = nullptr) {
190  return addTransitionImpl(State ? State : getState(), true, Pred, Tag);
191  }
192 
193  /// Add a sink node to the current path of execution, halting analysis.
194  void addSink(ProgramStateRef State = nullptr,
195  const ProgramPointTag *Tag = nullptr) {
196  if (!State)
197  State = getState();
199  }
200 
201  /// Generate a transition to a node that will be used to report
202  /// an error. This node will be a sink. That is, it will stop exploration of
203  /// the given path.
204  ///
205  /// @param State The state of the generated node.
206  /// @param Tag The tag to uniquely identify the creation site. If null,
207  /// the default tag for the checker will be used.
209  const ProgramPointTag *Tag = nullptr) {
210  return generateSink(State, Pred,
211  (Tag ? Tag : Location.getTag()));
212  }
213 
214  /// Generate a transition to a node that will be used to report
215  /// an error. This node will not be a sink. That is, exploration will
216  /// continue along this path.
217  ///
218  /// @param State The state of the generated node.
219  /// @param Tag The tag to uniquely identify the creation site. If null,
220  /// the default tag for the checker will be used.
221  ExplodedNode *
223  const ProgramPointTag *Tag = nullptr) {
224  return addTransition(State, (Tag ? Tag : Location.getTag()));
225  }
226 
227  /// Generate a transition to a node that will be used to report
228  /// an error. This node will not be a sink. That is, exploration will
229  /// continue along this path.
230  ///
231  /// @param State The state of the generated node.
232  /// @param Pred The transition will be generated from the specified Pred node
233  /// to the newly generated node.
234  /// @param Tag The tag to uniquely identify the creation site. If null,
235  /// the default tag for the checker will be used.
236  ExplodedNode *
238  ExplodedNode *Pred,
239  const ProgramPointTag *Tag = nullptr) {
240  return addTransition(State, Pred, (Tag ? Tag : Location.getTag()));
241  }
242 
243  /// Emit the diagnostics report.
244  void emitReport(std::unique_ptr<BugReport> R) {
245  Changed = true;
246  Eng.getBugReporter().emitReport(std::move(R));
247  }
248 
249  /// Produce a program point tag that displays an additional path note
250  /// to the user. This is a lightweight alternative to the
251  /// BugReporterVisitor mechanism: instead of visiting the bug report
252  /// node-by-node to restore the sequence of events that led to discovering
253  /// a bug, you can add notes as you add your transitions.
254  ///
255  /// @param Cb Callback with 'BugReporterContext &, BugReport &' parameters.
256  /// @param IsPrunable Whether the note is prunable. It allows BugReporter
257  /// to omit the note from the report if it would make the displayed
258  /// bug path significantly shorter.
259  const NoteTag *getNoteTag(NoteTag::Callback &&Cb, bool IsPrunable = false) {
260  return Eng.getDataTags().make<NoteTag>(std::move(Cb), IsPrunable);
261  }
262 
263  /// A shorthand version of getNoteTag that doesn't require you to accept
264  /// the 'BugReporterContext' argument when you don't need it.
265  ///
266  /// @param Cb Callback only with 'BugReport &' parameter.
267  /// @param IsPrunable Whether the note is prunable. It allows BugReporter
268  /// to omit the note from the report if it would make the displayed
269  /// bug path significantly shorter.
270  const NoteTag
272  bool IsPrunable = false) {
273  return getNoteTag(
274  [Cb](BugReporterContext &,
275  PathSensitiveBugReport &BR) { return Cb(BR); },
276  IsPrunable);
277  }
278 
279  /// A shorthand version of getNoteTag that doesn't require you to accept
280  /// the arguments when you don't need it.
281  ///
282  /// @param Cb Callback without parameters.
283  /// @param IsPrunable Whether the note is prunable. It allows BugReporter
284  /// to omit the note from the report if it would make the displayed
285  /// bug path significantly shorter.
286  const NoteTag *getNoteTag(std::function<std::string()> &&Cb,
287  bool IsPrunable = false) {
288  return getNoteTag([Cb](BugReporterContext &,
289  PathSensitiveBugReport &) { return Cb(); },
290  IsPrunable);
291  }
292 
293  /// A shorthand version of getNoteTag that accepts a plain note.
294  ///
295  /// @param Note The note.
296  /// @param IsPrunable Whether the note is prunable. It allows BugReporter
297  /// to omit the note from the report if it would make the displayed
298  /// bug path significantly shorter.
299  const NoteTag *getNoteTag(StringRef Note, bool IsPrunable = false) {
300  return getNoteTag(
301  [Note](BugReporterContext &,
302  PathSensitiveBugReport &) { return std::string(Note); },
303  IsPrunable);
304  }
305 
306  /// A shorthand version of getNoteTag that accepts a lambda with stream for
307  /// note.
308  ///
309  /// @param Cb Callback with 'BugReport &' and 'llvm::raw_ostream &'.
310  /// @param IsPrunable Whether the note is prunable. It allows BugReporter
311  /// to omit the note from the report if it would make the displayed
312  /// bug path significantly shorter.
314  std::function<void(PathSensitiveBugReport &BR, llvm::raw_ostream &OS)> &&Cb,
315  bool IsPrunable = false) {
316  return getNoteTag(
317  [Cb](PathSensitiveBugReport &BR) -> std::string {
319  llvm::raw_svector_ostream OS(Str);
320  Cb(BR, OS);
321  return std::string(OS.str());
322  },
323  IsPrunable);
324  }
325 
326  /// Returns the word that should be used to refer to the declaration
327  /// in the report.
328  StringRef getDeclDescription(const Decl *D);
329 
330  /// Get the declaration of the called function (path-sensitive).
331  const FunctionDecl *getCalleeDecl(const CallExpr *CE) const;
332 
333  /// Get the name of the called function (path-sensitive).
334  StringRef getCalleeName(const FunctionDecl *FunDecl) const;
335 
336  /// Get the identifier of the called function (path-sensitive).
337  const IdentifierInfo *getCalleeIdentifier(const CallExpr *CE) const {
338  const FunctionDecl *FunDecl = getCalleeDecl(CE);
339  if (FunDecl)
340  return FunDecl->getIdentifier();
341  else
342  return nullptr;
343  }
344 
345  /// Get the name of the called function (path-sensitive).
346  StringRef getCalleeName(const CallExpr *CE) const {
347  const FunctionDecl *FunDecl = getCalleeDecl(CE);
348  return getCalleeName(FunDecl);
349  }
350 
351  /// Returns true if the callee is an externally-visible function in the
352  /// top-level namespace, such as \c malloc.
353  ///
354  /// If a name is provided, the function must additionally match the given
355  /// name.
356  ///
357  /// Note that this deliberately excludes C++ library functions in the \c std
358  /// namespace, but will include C library functions accessed through the
359  /// \c std namespace. This also does not check if the function is declared
360  /// as 'extern "C"', or if it uses C++ name mangling.
361  static bool isCLibraryFunction(const FunctionDecl *FD,
362  StringRef Name = StringRef());
363 
364  /// Depending on wither the location corresponds to a macro, return
365  /// either the macro name or the token spelling.
366  ///
367  /// This could be useful when checkers' logic depends on whether a function
368  /// is called with a given macro argument. For example:
369  /// s = socket(AF_INET,..)
370  /// If AF_INET is a macro, the result should be treated as a source of taint.
371  ///
372  /// \sa clang::Lexer::getSpelling(), clang::Lexer::getImmediateMacroName().
374 
375 private:
376  ExplodedNode *addTransitionImpl(ProgramStateRef State,
377  bool MarkAsSink,
378  ExplodedNode *P = nullptr,
379  const ProgramPointTag *Tag = nullptr) {
380  // The analyzer may stop exploring if it sees a state it has previously
381  // visited ("cache out"). The early return here is a defensive check to
382  // prevent accidental caching out by checker API clients. Unless there is a
383  // tag or the client checker has requested that the generated node be
384  // marked as a sink, we assume that a client requesting a transition to a
385  // state that is the same as the predecessor state has made a mistake. We
386  // return the predecessor rather than cache out.
387  //
388  // TODO: We could potentially change the return to an assertion to alert
389  // clients to their mistake, but several checkers (including
390  // DereferenceChecker, CallAndMessageChecker, and DynamicTypePropagation)
391  // rely upon the defensive behavior and would need to be updated.
392  if (!State || (State == Pred->getState() && !Tag && !MarkAsSink))
393  return Pred;
394 
395  Changed = true;
396  const ProgramPoint &LocalLoc = (Tag ? Location.withTag(Tag) : Location);
397  if (!P)
398  P = Pred;
399 
401  if (MarkAsSink)
402  node = NB.generateSink(LocalLoc, State, P);
403  else
404  node = NB.generateNode(LocalLoc, State, P);
405  return node;
406  }
407 };
408 
409 } // end GR namespace
410 
411 } // end clang namespace
412 
413 #endif
clang::ento::CheckerContext::getNoteTag
const NoteTag * getNoteTag(NoteTag::Callback &&Cb, bool IsPrunable=false)
Produce a program point tag that displays an additional path note to the user.
Definition: CheckerContext.h:259
clang::ento::CheckerContext::getCalleeName
StringRef getCalleeName(const CallExpr *CE) const
Get the name of the called function (path-sensitive).
Definition: CheckerContext.h:346
clang::ento::ExprEngine::getStateManager
ProgramStateManager & getStateManager()
Definition: ExprEngine.h:411
clang::ProgramPoint::withTag
ProgramPoint withTag(const ProgramPointTag *tag) const
Create a new ProgramPoint object that is the same as the original except for using the specified tag ...
Definition: ProgramPoint.h:131
clang::ento::ExplodedNode::getLocationContext
const LocationContext * getLocationContext() const
Definition: ExplodedGraph.h:146
clang::LocationContext
It wraps the AnalysisDeclContext to represent both the call stack with the help of StackFrameContext ...
Definition: AnalysisDeclContext.h:215
string
string(SUBSTRING ${CMAKE_CURRENT_BINARY_DIR} 0 ${PATH_LIB_START} PATH_HEAD) string(SUBSTRING $
Definition: CMakeLists.txt:22
clang::ento::CheckerContext::getASTContext
const ASTContext & getASTContext() const
Definition: CheckerContext.h:87
clang::ento::CheckerContext::getDeclDescription
StringRef getDeclDescription(const Decl *D)
Returns the word that should be used to refer to the declaration in the report.
Definition: CheckerContext.cpp:40
clang::ento::CheckerContext::getNoteTag
const NoteTag * getNoteTag(StringRef Note, bool IsPrunable=false)
A shorthand version of getNoteTag that accepts a plain note.
Definition: CheckerContext.h:299
clang::ento::ConstraintManager
Definition: ConstraintManager.h:77
clang::ento::ExprEngine::getDataTags
DataTag::Factory & getDataTags()
Definition: ExprEngine.h:427
clang::ProgramPointTag
ProgramPoints can be "tagged" as representing points specific to a given analysis entity.
Definition: ProgramPoint.h:38
clang::SourceLocation
Encodes a location in the source.
Definition: SourceLocation.h:86
clang::ento::ExprEngine::getContext
ASTContext & getContext() const
getContext - Return the ASTContext associated with this analysis.
Definition: ExprEngine.h:202
clang::ento::CheckerContext::getLocationContext
const LocationContext * getLocationContext() const
Definition: CheckerContext.h:93
clang::CFGBlock::getBlockID
unsigned getBlockID() const
Definition: CFG.h:1074
clang::ento::CheckerContext::getCalleeDecl
const FunctionDecl * getCalleeDecl(const CallExpr *CE) const
Get the declaration of the called function (path-sensitive).
Definition: CheckerContext.cpp:21
clang::AnalysisDeclContext
AnalysisDeclContext contains the context data for the function, method or block under analysis.
Definition: AnalysisDeclContext.h:72
clang::ento::ExplodedNode::getStackFrame
const StackFrameContext * getStackFrame() const
Definition: ExplodedGraph.h:150
clang::ento::CheckerContext::generateNonFatalErrorNode
ExplodedNode * generateNonFatalErrorNode(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generate a transition to a node that will be used to report an error.
Definition: CheckerContext.h:222
clang::ento::ExplodedNode
Definition: ExplodedGraph.h:65
clang::ento::CheckerContext::getStoreManager
StoreManager & getStoreManager()
Definition: CheckerContext.h:63
clang::ento::CheckerContext::getNoteTag
const NoteTag * getNoteTag(std::function< std::string()> &&Cb, bool IsPrunable=false)
A shorthand version of getNoteTag that doesn't require you to accept the arguments when you don't nee...
Definition: CheckerContext.h:286
clang::ento::CheckerContext::addSink
void addSink(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Add a sink node to the current path of execution, halting analysis.
Definition: CheckerContext.h:194
clang::ento::CheckerContext::getLocationRegionIfPostStore
static const MemRegion * getLocationRegionIfPostStore(const ExplodedNode *N)
If the given node corresponds to a PostStore program point, retrieve the location region as it was ut...
Definition: CheckerContext.h:140
llvm::Optional
Definition: LLVM.h:40
clang::ento::CheckerContext::isGreaterOrEqual
bool isGreaterOrEqual(const Expr *E, unsigned long long Val)
Returns true if the value of E is greater than or equal to Val under unsigned comparison.
Definition: CheckerContext.cpp:147
clang::StackFrameContext
It represents a stack frame of the call stack (based on CallEvent).
Definition: AnalysisDeclContext.h:295
clang::ento::CheckerContext::getCurrentAnalysisDeclContext
AnalysisDeclContext * getCurrentAnalysisDeclContext() const
Definition: CheckerContext.h:126
clang::ento::CheckerContext::generateErrorNode
ExplodedNode * generateErrorNode(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generate a transition to a node that will be used to report an error.
Definition: CheckerContext.h:208
clang::ento::CheckerContext::getState
const ProgramStateRef & getState() const
Definition: CheckerContext.h:71
clang::ento::CheckerContext::getPreprocessor
Preprocessor & getPreprocessor()
Definition: CheckerContext.h:112
clang::ento::StoreManager
Definition: Store.h:53
clang::SourceManager
This class handles loading and caching of source files into memory.
Definition: SourceManager.h:627
clang::ento::MemRegion
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:94
clang::ento::CheckerContext::getCalleeIdentifier
const IdentifierInfo * getCalleeIdentifier(const CallExpr *CE) const
Get the identifier of the called function (path-sensitive).
Definition: CheckerContext.h:337
clang::ento::ExplodedNode::getState
const ProgramStateRef & getState() const
Definition: ExplodedGraph.h:168
clang::ento::NodeBuilder
Definition: CoreEngine.h:237
clang::LocationContext::getAnalysisDeclContext
AnalysisDeclContext * getAnalysisDeclContext() const
Definition: AnalysisDeclContext.h:241
clang::ento::NodeBuilder::generateSink
ExplodedNode * generateSink(const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred)
Generates a sink in the ExplodedGraph.
Definition: CoreEngine.h:303
clang::ento::BugReporter::emitReport
virtual void emitReport(std::unique_ptr< BugReport > R)
Add the given report to the set of reports tracked by BugReporter.
Definition: BugReporter.cpp:2897
clang::ento::BugReporter::getPreprocessor
Preprocessor & getPreprocessor()
Definition: BugReporter.h:620
clang::ento::DataTag::Factory::make
const DataTagType * make(Args &&... ConstructorArgs)
Definition: BugReporter.h:748
clang::LocationContext::inTopFrame
virtual bool inTopFrame() const
Definition: AnalysisDeclContext.cpp:473
clang::ento::CheckerContext::getAnalysisManager
AnalysisManager & getAnalysisManager()
Definition: CheckerContext.h:55
clang::ASTContext
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:208
clang::ProgramPoint::getAs
Optional< T > getAs() const
Convert to the specified ProgramPoint type, returning None if this ProgramPoint is not of the desired...
Definition: ProgramPoint.h:150
clang::ento::CheckerContext::getCalleeName
StringRef getCalleeName(const FunctionDecl *FunDecl) const
Get the name of the called function (path-sensitive).
Definition: CheckerContext.cpp:31
clang::ProgramPoint::getTag
const ProgramPointTag * getTag() const
Definition: ProgramPoint.h:176
clang::PostStore
Represents a program point after a store evaluation.
Definition: ProgramPoint.h:430
clang::ento::CheckerContext::getSymbolManager
SymbolManager & getSymbolManager()
Definition: CheckerContext.h:118
clang::ento::CheckerContext::getNoteTag
const NoteTag * getNoteTag(std::function< void(PathSensitiveBugReport &BR, llvm::raw_ostream &OS)> &&Cb, bool IsPrunable=false)
A shorthand version of getNoteTag that accepts a lambda with stream for note.
Definition: CheckerContext.h:313
clang::ento::CheckerContext::addTransition
ExplodedNode * addTransition(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generates a new transition in the program state graph (ExplodedGraph).
Definition: CheckerContext.h:168
llvm::SmallString< 128 >
clang::ento::CheckerContext::emitReport
void emitReport(std::unique_ptr< BugReport > R)
Emit the diagnostics report.
Definition: CheckerContext.h:244
clang::ento::BugReporterContext
Definition: BugReporter.h:701
clang::ento::CheckerContext::inTopFrame
bool inTopFrame() const
Return true if the current LocationContext has no caller context.
Definition: CheckerContext.h:102
clang::ento::BugReporter
BugReporter is a utility class for generating PathDiagnostics for analysis.
Definition: BugReporter.h:585
clang::ento::NodeBuilderContext::blockCount
unsigned blockCount() const
Returns the number of times the current basic block has been visited on the exploded graph path.
Definition: CoreEngine.h:221
clang::ento::CheckerContext::getMacroNameOrSpelling
StringRef getMacroNameOrSpelling(SourceLocation &Loc)
Depending on wither the location corresponds to a macro, return either the macro name or the token sp...
Definition: CheckerContext.cpp:116
clang::ento::CheckerContext::getStateManager
ProgramStateManager & getStateManager()
Definition: CheckerContext.h:122
clang::ento::CheckerContext::getSourceManager
const SourceManager & getSourceManager()
Definition: CheckerContext.h:108
clang::ento::CheckerContext::getLangOpts
const LangOptions & getLangOpts() const
Definition: CheckerContext.h:89
clang::ento::Loc
Definition: SVals.h:326
clang::ento::CheckerContext::getSValBuilder
SValBuilder & getSValBuilder()
Definition: CheckerContext.h:114
clang::ento::CheckerContext::getPredecessor
ExplodedNode * getPredecessor()
Returns the previous node in the exploded graph, which includes the state of the program before the c...
Definition: CheckerContext.h:70
clang::ento::ExprEngine::getConstraintManager
ConstraintManager & getConstraintManager()
Definition: ExprEngine.h:415
clang::ento::SValBuilder
Definition: SValBuilder.h:53
clang::ento::NodeBuilder::getContext
const NodeBuilderContext & getContext()
Definition: CoreEngine.h:329
clang::ento::CheckerContext::getNoteTag
const NoteTag * getNoteTag(std::function< std::string(PathSensitiveBugReport &)> &&Cb, bool IsPrunable=false)
A shorthand version of getNoteTag that doesn't require you to accept the 'BugReporterContext' argumen...
Definition: CheckerContext.h:271
P
StringRef P
Definition: ASTMatchersInternal.cpp:563
clang::ento::ProgramStateManager
Definition: ProgramState.h:498
clang::ento::BugReporter::getSourceManager
const SourceManager & getSourceManager()
Definition: BugReporter.h:616
clang::ento::CheckerContext::getASTContext
ASTContext & getASTContext()
Definition: CheckerContext.h:83
false
#define false
Definition: stdbool.h:22
clang::NamedDecl::getIdentifier
IdentifierInfo * getIdentifier() const
Get the identifier that names this declaration, if there is one.
Definition: Decl.h:268
clang::Decl
Decl - This represents one declaration (or definition), e.g.
Definition: DeclBase.h:83
State
LineState State
Definition: UnwrappedLineFormatter.cpp:1089
clang::ento::ExprEngine::getSValBuilder
SValBuilder & getSValBuilder()
Definition: ExprEngine.h:214
clang::ento::ExprEngine::getBugReporter
BugReporter & getBugReporter()
Definition: ExprEngine.h:216
clang::ento::AnalysisManager
Definition: AnalysisManager.h:31
clang::IdentifierInfo
One of these records is kept for each identifier that is lexed.
Definition: IdentifierTable.h:84
clang::ento::ExprEngine::getAnalysisManager
AnalysisManager & getAnalysisManager()
Definition: ExprEngine.h:204
clang::ento::CheckerContext::isCLibraryFunction
static bool isCLibraryFunction(const FunctionDecl *FD, StringRef Name=StringRef())
Returns true if the callee is an externally-visible function in the top-level namespace,...
Definition: CheckerContext.cpp:48
clang::LangOptions
Keeps track of the various options that can be enabled, which controls the dialect of C or C++ that i...
Definition: LangOptions.h:78
clang::ento::ExprEngine
Definition: ExprEngine.h:123
clang::ento::CheckerContext::addTransition
ExplodedNode * addTransition(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
Generates a new transition with the given predecessor.
Definition: CheckerContext.h:180
clang::ento::PathSensitiveBugReport
Definition: BugReporter.h:289
ExprEngine.h
clang::ento::CheckerContext::getBugReporter
BugReporter & getBugReporter()
Definition: CheckerContext.h:104
clang::ento::ExprEngine::getStoreManager
StoreManager & getStoreManager()
Definition: ExprEngine.h:413
clang::ento::CheckerContext::isNegative
bool isNegative(const Expr *E)
Returns true if the value of E is negative.
Definition: CheckerContext.cpp:152
clang::ento::CheckerContext::generateNonFatalErrorNode
ExplodedNode * generateNonFatalErrorNode(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
Generate a transition to a node that will be used to report an error.
Definition: CheckerContext.h:237
clang::ento::CheckerContext::getStackFrame
const StackFrameContext * getStackFrame() const
Definition: CheckerContext.h:97
clang
Definition: CalledOnceCheck.h:17
clang::ento::ExplodedNode::getLocation
ProgramPoint getLocation() const
getLocation - Returns the edge associated with the given node.
Definition: ExplodedGraph.h:144
clang::Stmt
Stmt - This represents one statement.
Definition: Stmt.h:69
clang::ento::NodeBuilder::generateNode
ExplodedNode * generateNode(const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred)
Generates a node in the ExplodedGraph.
Definition: CoreEngine.h:290
clang::ento::CheckerContext::generateSink
ExplodedNode * generateSink(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
Generate a sink node.
Definition: CheckerContext.h:188
clang::ento::NodeBuilderContext::getBlock
const CFGBlock * getBlock() const
Return the CFGBlock associated with this builder.
Definition: CoreEngine.h:217
clang::ento::CheckerContext::getBlockID
unsigned getBlockID() const
Get the blockID.
Definition: CheckerContext.h:131
clang::ento::ExplodedNode::getSVal
SVal getSVal(const Stmt *S) const
Get the value of an arbitrary expression at this node.
Definition: ExplodedGraph.h:175
clang::ento::SValBuilder::getSymbolManager
SymbolManager & getSymbolManager()
Definition: SValBuilder.h:183
clang::ento::CheckerContext
Definition: CheckerContext.h:23
clang::ento::CheckerContext::CheckerContext
CheckerContext(NodeBuilder &builder, ExprEngine &eng, ExplodedNode *pred, const ProgramPoint &loc, bool wasInlined=false)
Definition: CheckerContext.h:40
clang::ento::SVal
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
Definition: SVals.h:74
clang::transformer::node
RangeSelector node(std::string ID)
Selects a node, including trailing semicolon, if any (for declarations and non-expression statements)...
Definition: RangeSelector.cpp:141
ProgramStateTrait.h
clang::Expr
This represents one expression.
Definition: Expr.h:109
clang::ento::CheckerContext::getConstraintManager
ConstraintManager & getConstraintManager()
Definition: CheckerContext.h:59
clang::Preprocessor
Engages in a tight little dance with the lexer to efficiently preprocess tokens.
Definition: Preprocessor.h:131
clang::ento::CheckerContext::wasInlined
const bool wasInlined
If we are post visiting a call, this flag will be set if the call was inlined.
Definition: CheckerContext.h:38
clang::ento::CheckerContext::getSVal
SVal getSVal(const Stmt *S) const
Get the value of arbitrary expressions at this point in the path.
Definition: CheckerContext.h:148
clang::ento::NoteTag
The tag upon which the TagVisitor reacts.
Definition: BugReporter.h:763
clang::ento::NoteTag::Callback
std::function< std::string(BugReporterContext &, PathSensitiveBugReport &)> Callback
Definition: BugReporter.h:766
clang::FunctionDecl
Represents a function declaration or definition.
Definition: Decl.h:1872
clang::ProgramPoint
Definition: ProgramPoint.h:58
clang::CallExpr
CallExpr - Represents a function call (C99 6.5.2.2, C++ [expr.call]).
Definition: Expr.h:2801
clang::ento::CheckerContext::blockCount
unsigned blockCount() const
Returns the number of times the current block has been visited along the analyzed path.
Definition: CheckerContext.h:79
clang::ento::SymbolManager
Definition: SymbolManager.h:417
clang::ASTContext::getLangOpts
const LangOptions & getLangOpts() const
Definition: ASTContext.h:786
llvm::IntrusiveRefCntPtr< const ProgramState >
clang::ento::ObjKind::OS
@ OS
Indicates that the tracking object is a descendant of a referenced-counted OSObject,...
clang::ento::CheckerContext::isDifferent
bool isDifferent()
Check if the checker changed the state of the execution; ex: added a new transition or a bug report.
Definition: CheckerContext.h:75