clang 20.0.0git
CheckerContext.h
Go to the documentation of this file.
1//== CheckerContext.h - Context info for path-sensitive checkers--*- C++ -*--=//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file defines CheckerContext that provides contextual info for
10// path-sensitive checkers.
11//
12//===----------------------------------------------------------------------===//
13
14#ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CHECKERCONTEXT_H
15#define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CHECKERCONTEXT_H
16
19#include <optional>
20
21namespace clang {
22namespace ento {
23
25 ExprEngine &Eng;
26 /// The current exploded(symbolic execution) graph node.
27 ExplodedNode *Pred;
28 /// The flag is true if the (state of the execution) has been modified
29 /// by the checker using this context. For example, a new transition has been
30 /// added or a bug report issued.
31 bool Changed;
32 /// The tagged location, which is used to generate all new nodes.
33 const ProgramPoint Location;
34 NodeBuilder &NB;
35
36public:
37 /// If we are post visiting a call, this flag will be set if the
38 /// call was inlined. In all other cases it will be false.
39 const bool wasInlined;
40
42 ExprEngine &eng,
43 ExplodedNode *pred,
44 const ProgramPoint &loc,
45 bool wasInlined = false)
46 : Eng(eng),
47 Pred(pred),
48 Changed(false),
49 Location(loc),
50 NB(builder),
52 assert(Pred->getState() &&
53 "We should not call the checkers on an empty state.");
54 }
55
57 return Eng.getAnalysisManager();
58 }
59
61 return Eng.getConstraintManager();
62 }
63
65 return Eng.getStoreManager();
66 }
67
68 /// Returns the previous node in the exploded graph, which includes
69 /// the state of the program before the checker ran. Note, checkers should
70 /// not retain the node in their state since the nodes might get invalidated.
71 ExplodedNode *getPredecessor() { return Pred; }
72 const ProgramStateRef &getState() const { return Pred->getState(); }
73
74 /// Check if the checker changed the state of the execution; ex: added
75 /// a new transition or a bug report.
76 bool isDifferent() { return Changed; }
77
78 /// Returns the number of times the current block has been visited
79 /// along the analyzed path.
80 unsigned blockCount() const {
81 return NB.getContext().blockCount();
82 }
83
85 return Eng.getContext();
86 }
87
88 const ASTContext &getASTContext() const { return Eng.getContext(); }
89
90 const LangOptions &getLangOpts() const {
91 return Eng.getContext().getLangOpts();
92 }
93
95 return Pred->getLocationContext();
96 }
97
99 return Pred->getStackFrame();
100 }
101
102 /// Return true if the current LocationContext has no caller context.
103 bool inTopFrame() const { return getLocationContext()->inTopFrame(); }
104
106 return Eng.getBugReporter();
107 }
108
111 }
112
114
116 return Eng.getSValBuilder();
117 }
118
121 }
122
124 return Eng.getStateManager();
125 }
126
129 }
130
131 /// Get the blockID.
132 unsigned getBlockID() const {
133 return NB.getContext().getBlock()->getBlockID();
134 }
135
136 /// If the given node corresponds to a PostStore program point,
137 /// retrieve the location region as it was uttered in the code.
138 ///
139 /// This utility can be useful for generating extensive diagnostics, for
140 /// example, for finding variables that the given symbol was assigned to.
142 ProgramPoint L = N->getLocation();
143 if (std::optional<PostStore> PSL = L.getAs<PostStore>())
144 return reinterpret_cast<const MemRegion*>(PSL->getLocationValue());
145 return nullptr;
146 }
147
148 /// Get the value of arbitrary expressions at this point in the path.
149 SVal getSVal(const Stmt *S) const {
150 return Pred->getSVal(S);
151 }
152
153 /// Returns true if the value of \p E is greater than or equal to \p
154 /// Val under unsigned comparison
155 bool isGreaterOrEqual(const Expr *E, unsigned long long Val);
156
157 /// Returns true if the value of \p E is negative.
158 bool isNegative(const Expr *E);
159
160 /// Generates a new transition in the program state graph
161 /// (ExplodedGraph). Uses the default CheckerContext predecessor node.
162 ///
163 /// @param State The state of the generated node. If not specified, the state
164 /// will not be changed, but the new node will have the checker's tag.
165 /// @param Tag The tag is used to uniquely identify the creation site. If no
166 /// tag is specified, a default tag, unique to the given checker,
167 /// will be used. Tags are used to prevent states generated at
168 /// different sites from caching out.
170 const ProgramPointTag *Tag = nullptr) {
171 return addTransitionImpl(State ? State : getState(), false, nullptr, Tag);
172 }
173
174 /// Generates a new transition with the given predecessor.
175 /// Allows checkers to generate a chain of nodes.
176 ///
177 /// @param State The state of the generated node.
178 /// @param Pred The transition will be generated from the specified Pred node
179 /// to the newly generated node.
180 /// @param Tag The tag to uniquely identify the creation site.
182 const ProgramPointTag *Tag = nullptr) {
183 return addTransitionImpl(State, false, Pred, Tag);
184 }
185
186 /// Generate a sink node. Generating a sink stops exploration of the
187 /// given path. To create a sink node for the purpose of reporting an error,
188 /// checkers should use generateErrorNode() instead.
190 const ProgramPointTag *Tag = nullptr) {
191 return addTransitionImpl(State ? State : getState(), true, Pred, Tag);
192 }
193
194 /// Add a sink node to the current path of execution, halting analysis.
195 void addSink(ProgramStateRef State = nullptr,
196 const ProgramPointTag *Tag = nullptr) {
197 if (!State)
198 State = getState();
199 addTransition(State, generateSink(State, getPredecessor()));
200 }
201
202 /// Generate a transition to a node that will be used to report
203 /// an error. This node will be a sink. That is, it will stop exploration of
204 /// the given path.
205 ///
206 /// @param State The state of the generated node.
207 /// @param Tag The tag to uniquely identify the creation site. If null,
208 /// the default tag for the checker will be used.
210 const ProgramPointTag *Tag = nullptr) {
211 return generateSink(State, Pred,
212 (Tag ? Tag : Location.getTag()));
213 }
214
215 /// Generate a transition to a node that will be used to report
216 /// an error. This node will be a sink. That is, it will stop exploration of
217 /// the given path.
218 ///
219 /// @param State The state of the generated node.
220 /// @param Pred The transition will be generated from the specified Pred node
221 /// to the newly generated node.
222 /// @param Tag The tag to uniquely identify the creation site. If null,
223 /// the default tag for the checker will be used.
225 ExplodedNode *Pred,
226 const ProgramPointTag *Tag = nullptr) {
227 return generateSink(State, Pred,
228 (Tag ? Tag : Location.getTag()));
229 }
230
231 /// Generate a transition to a node that will be used to report
232 /// an error. This node will not be a sink. That is, exploration will
233 /// continue along this path.
234 ///
235 /// @param State The state of the generated node.
236 /// @param Tag The tag to uniquely identify the creation site. If null,
237 /// the default tag for the checker will be used.
240 const ProgramPointTag *Tag = nullptr) {
241 return addTransition(State, (Tag ? Tag : Location.getTag()));
242 }
243
244 /// Generate a transition to a node that will be used to report
245 /// an error. This node will not be a sink. That is, exploration will
246 /// continue along this path.
247 ///
248 /// @param State The state of the generated node.
249 /// @param Pred The transition will be generated from the specified Pred node
250 /// to the newly generated node.
251 /// @param Tag The tag to uniquely identify the creation site. If null,
252 /// the default tag for the checker will be used.
255 ExplodedNode *Pred,
256 const ProgramPointTag *Tag = nullptr) {
257 return addTransition(State, Pred, (Tag ? Tag : Location.getTag()));
258 }
259
260 /// Emit the diagnostics report.
261 void emitReport(std::unique_ptr<BugReport> R) {
262 Changed = true;
263 Eng.getBugReporter().emitReport(std::move(R));
264 }
265
266 /// Produce a program point tag that displays an additional path note
267 /// to the user. This is a lightweight alternative to the
268 /// BugReporterVisitor mechanism: instead of visiting the bug report
269 /// node-by-node to restore the sequence of events that led to discovering
270 /// a bug, you can add notes as you add your transitions.
271 ///
272 /// @param Cb Callback with 'BugReporterContext &, BugReport &' parameters.
273 /// @param IsPrunable Whether the note is prunable. It allows BugReporter
274 /// to omit the note from the report if it would make the displayed
275 /// bug path significantly shorter.
276 LLVM_ATTRIBUTE_RETURNS_NONNULL
277 const NoteTag *getNoteTag(NoteTag::Callback &&Cb, bool IsPrunable = false) {
278 return Eng.getDataTags().make<NoteTag>(std::move(Cb), IsPrunable);
279 }
280
281 /// A shorthand version of getNoteTag that doesn't require you to accept
282 /// the 'BugReporterContext' argument when you don't need it.
283 ///
284 /// @param Cb Callback only with 'BugReport &' parameter.
285 /// @param IsPrunable Whether the note is prunable. It allows BugReporter
286 /// to omit the note from the report if it would make the displayed
287 /// bug path significantly shorter.
288 const NoteTag
289 *getNoteTag(std::function<std::string(PathSensitiveBugReport &)> &&Cb,
290 bool IsPrunable = false) {
291 return getNoteTag(
292 [Cb](BugReporterContext &,
293 PathSensitiveBugReport &BR) { return Cb(BR); },
294 IsPrunable);
295 }
296
297 /// A shorthand version of getNoteTag that doesn't require you to accept
298 /// the arguments when you don't need it.
299 ///
300 /// @param Cb Callback without parameters.
301 /// @param IsPrunable Whether the note is prunable. It allows BugReporter
302 /// to omit the note from the report if it would make the displayed
303 /// bug path significantly shorter.
304 const NoteTag *getNoteTag(std::function<std::string()> &&Cb,
305 bool IsPrunable = false) {
306 return getNoteTag([Cb](BugReporterContext &,
307 PathSensitiveBugReport &) { return Cb(); },
308 IsPrunable);
309 }
310
311 /// A shorthand version of getNoteTag that accepts a plain note.
312 ///
313 /// @param Note The note.
314 /// @param IsPrunable Whether the note is prunable. It allows BugReporter
315 /// to omit the note from the report if it would make the displayed
316 /// bug path significantly shorter.
317 const NoteTag *getNoteTag(StringRef Note, bool IsPrunable = false) {
318 return getNoteTag(
319 [Note = std::string(Note)](BugReporterContext &,
320 PathSensitiveBugReport &) { return Note; },
321 IsPrunable);
322 }
323
324 /// A shorthand version of getNoteTag that accepts a lambda with stream for
325 /// note.
326 ///
327 /// @param Cb Callback with 'BugReport &' and 'llvm::raw_ostream &'.
328 /// @param IsPrunable Whether the note is prunable. It allows BugReporter
329 /// to omit the note from the report if it would make the displayed
330 /// bug path significantly shorter.
332 std::function<void(PathSensitiveBugReport &BR, llvm::raw_ostream &OS)> &&Cb,
333 bool IsPrunable = false) {
334 return getNoteTag(
335 [Cb](PathSensitiveBugReport &BR) -> std::string {
337 llvm::raw_svector_ostream OS(Str);
338 Cb(BR, OS);
339 return std::string(OS.str());
340 },
341 IsPrunable);
342 }
343
344 /// Returns the word that should be used to refer to the declaration
345 /// in the report.
346 StringRef getDeclDescription(const Decl *D);
347
348 /// Get the declaration of the called function (path-sensitive).
349 const FunctionDecl *getCalleeDecl(const CallExpr *CE) const;
350
351 /// Get the name of the called function (path-sensitive).
352 StringRef getCalleeName(const FunctionDecl *FunDecl) const;
353
354 /// Get the identifier of the called function (path-sensitive).
356 const FunctionDecl *FunDecl = getCalleeDecl(CE);
357 if (FunDecl)
358 return FunDecl->getIdentifier();
359 else
360 return nullptr;
361 }
362
363 /// Get the name of the called function (path-sensitive).
364 StringRef getCalleeName(const CallExpr *CE) const {
365 const FunctionDecl *FunDecl = getCalleeDecl(CE);
366 return getCalleeName(FunDecl);
367 }
368
369 /// Returns true if the given function is an externally-visible function in
370 /// the top-level namespace, such as \c malloc.
371 ///
372 /// If a name is provided, the function must additionally match the given
373 /// name.
374 ///
375 /// Note that this also accepts functions from the \c std namespace (because
376 /// headers like <cstdlib> declare them there) and does not check if the
377 /// function is declared as 'extern "C"' or if it uses C++ name mangling.
378 static bool isCLibraryFunction(const FunctionDecl *FD,
379 StringRef Name = StringRef());
380
381 /// In builds that use source hardening (-D_FORTIFY_SOURCE), many standard
382 /// functions are implemented as macros that expand to calls of hardened
383 /// functions that take additional arguments compared to the "usual"
384 /// variant and perform additional input validation. For example, a `memcpy`
385 /// call may expand to `__memcpy_chk()` or `__builtin___memcpy_chk()`.
386 ///
387 /// This method returns true if `FD` declares a fortified variant of the
388 /// standard library function `Name`.
389 ///
390 /// NOTE: This method relies on heuristics; extend it if you need to handle a
391 /// hardened variant that's not yet covered by it.
392 static bool isHardenedVariantOf(const FunctionDecl *FD, StringRef Name);
393
394 /// Depending on wither the location corresponds to a macro, return
395 /// either the macro name or the token spelling.
396 ///
397 /// This could be useful when checkers' logic depends on whether a function
398 /// is called with a given macro argument. For example:
399 /// s = socket(AF_INET,..)
400 /// If AF_INET is a macro, the result should be treated as a source of taint.
401 ///
402 /// \sa clang::Lexer::getSpelling(), clang::Lexer::getImmediateMacroName().
404
405private:
406 ExplodedNode *addTransitionImpl(ProgramStateRef State,
407 bool MarkAsSink,
408 ExplodedNode *P = nullptr,
409 const ProgramPointTag *Tag = nullptr) {
410 // The analyzer may stop exploring if it sees a state it has previously
411 // visited ("cache out"). The early return here is a defensive check to
412 // prevent accidental caching out by checker API clients. Unless there is a
413 // tag or the client checker has requested that the generated node be
414 // marked as a sink, we assume that a client requesting a transition to a
415 // state that is the same as the predecessor state has made a mistake. We
416 // return the predecessor rather than cache out.
417 //
418 // TODO: We could potentially change the return to an assertion to alert
419 // clients to their mistake, but several checkers (including
420 // DereferenceChecker, CallAndMessageChecker, and DynamicTypePropagation)
421 // rely upon the defensive behavior and would need to be updated.
422 if (!State || (State == Pred->getState() && !Tag && !MarkAsSink))
423 return Pred;
424
425 Changed = true;
426 const ProgramPoint &LocalLoc = (Tag ? Location.withTag(Tag) : Location);
427 if (!P)
428 P = Pred;
429
430 ExplodedNode *node;
431 if (MarkAsSink)
432 node = NB.generateSink(LocalLoc, State, P);
433 else
434 node = NB.generateNode(LocalLoc, State, P);
435 return node;
436 }
437};
438
439} // end GR namespace
440
441} // end clang namespace
442
443#endif
StringRef P
const Decl * D
Expr * E
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:187
const LangOptions & getLangOpts() const
Definition: ASTContext.h:797
AnalysisDeclContext contains the context data for the function, method or block under analysis.
unsigned getBlockID() const
Definition: CFG.h:1105
CallExpr - Represents a function call (C99 6.5.2.2, C++ [expr.call]).
Definition: Expr.h:2830
Decl - This represents one declaration (or definition), e.g.
Definition: DeclBase.h:86
This represents one expression.
Definition: Expr.h:110
Represents a function declaration or definition.
Definition: Decl.h:1932
One of these records is kept for each identifier that is lexed.
Keeps track of the various options that can be enabled, which controls the dialect of C or C++ that i...
Definition: LangOptions.h:461
It wraps the AnalysisDeclContext to represent both the call stack with the help of StackFrameContext ...
LLVM_ATTRIBUTE_RETURNS_NONNULL AnalysisDeclContext * getAnalysisDeclContext() const
virtual bool inTopFrame() const
IdentifierInfo * getIdentifier() const
Get the identifier that names this declaration, if there is one.
Definition: Decl.h:270
Represents a program point after a store evaluation.
Definition: ProgramPoint.h:426
Engages in a tight little dance with the lexer to efficiently preprocess tokens.
Definition: Preprocessor.h:137
ProgramPoints can be "tagged" as representing points specific to a given analysis entity.
Definition: ProgramPoint.h:38
const ProgramPointTag * getTag() const
Definition: ProgramPoint.h:173
ProgramPoint withTag(const ProgramPointTag *tag) const
Create a new ProgramPoint object that is the same as the original except for using the specified tag ...
Definition: ProgramPoint.h:129
std::optional< T > getAs() const
Convert to the specified ProgramPoint type, returning std::nullopt if this ProgramPoint is not of the...
Definition: ProgramPoint.h:147
Encodes a location in the source.
This class handles loading and caching of source files into memory.
It represents a stack frame of the call stack (based on CallEvent).
Stmt - This represents one statement.
Definition: Stmt.h:84
BugReporter is a utility class for generating PathDiagnostics for analysis.
Definition: BugReporter.h:585
Preprocessor & getPreprocessor()
Definition: BugReporter.h:627
const SourceManager & getSourceManager()
Definition: BugReporter.h:623
virtual void emitReport(std::unique_ptr< BugReport > R)
Add the given report to the set of reports tracked by BugReporter.
ExplodedNode * getPredecessor()
Returns the previous node in the exploded graph, which includes the state of the program before the c...
ExplodedNode * generateErrorNode(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
Generate a transition to a node that will be used to report an error.
const IdentifierInfo * getCalleeIdentifier(const CallExpr *CE) const
Get the identifier of the called function (path-sensitive).
static const MemRegion * getLocationRegionIfPostStore(const ExplodedNode *N)
If the given node corresponds to a PostStore program point, retrieve the location region as it was ut...
SymbolManager & getSymbolManager()
StringRef getDeclDescription(const Decl *D)
Returns the word that should be used to refer to the declaration in the report.
Preprocessor & getPreprocessor()
unsigned blockCount() const
Returns the number of times the current block has been visited along the analyzed path.
ExplodedNode * generateSink(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
Generate a sink node.
const SourceManager & getSourceManager()
SValBuilder & getSValBuilder()
CheckerContext(NodeBuilder &builder, ExprEngine &eng, ExplodedNode *pred, const ProgramPoint &loc, bool wasInlined=false)
const NoteTag * getNoteTag(std::function< std::string()> &&Cb, bool IsPrunable=false)
A shorthand version of getNoteTag that doesn't require you to accept the arguments when you don't nee...
StringRef getCalleeName(const FunctionDecl *FunDecl) const
Get the name of the called function (path-sensitive).
const NoteTag * getNoteTag(StringRef Note, bool IsPrunable=false)
A shorthand version of getNoteTag that accepts a plain note.
const StackFrameContext * getStackFrame() const
StringRef getCalleeName(const CallExpr *CE) const
Get the name of the called function (path-sensitive).
const ProgramStateRef & getState() const
ExplodedNode * addTransition(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generates a new transition in the program state graph (ExplodedGraph).
ConstraintManager & getConstraintManager()
SVal getSVal(const Stmt *S) const
Get the value of arbitrary expressions at this point in the path.
BugReporter & getBugReporter()
bool isDifferent()
Check if the checker changed the state of the execution; ex: added a new transition or a bug report.
ExplodedNode * addTransition(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
Generates a new transition with the given predecessor.
bool isNegative(const Expr *E)
Returns true if the value of E is negative.
AnalysisDeclContext * getCurrentAnalysisDeclContext() const
bool isGreaterOrEqual(const Expr *E, unsigned long long Val)
Returns true if the value of E is greater than or equal to Val under unsigned comparison.
static bool isCLibraryFunction(const FunctionDecl *FD, StringRef Name=StringRef())
Returns true if the given function is an externally-visible function in the top-level namespace,...
ExplodedNode * generateNonFatalErrorNode(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generate a transition to a node that will be used to report an error.
LLVM_ATTRIBUTE_RETURNS_NONNULL const NoteTag * getNoteTag(NoteTag::Callback &&Cb, bool IsPrunable=false)
Produce a program point tag that displays an additional path note to the user.
const ASTContext & getASTContext() const
AnalysisManager & getAnalysisManager()
ExplodedNode * generateErrorNode(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generate a transition to a node that will be used to report an error.
const FunctionDecl * getCalleeDecl(const CallExpr *CE) const
Get the declaration of the called function (path-sensitive).
void addSink(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Add a sink node to the current path of execution, halting analysis.
const NoteTag * getNoteTag(std::function< void(PathSensitiveBugReport &BR, llvm::raw_ostream &OS)> &&Cb, bool IsPrunable=false)
A shorthand version of getNoteTag that accepts a lambda with stream for note.
ProgramStateManager & getStateManager()
StringRef getMacroNameOrSpelling(SourceLocation &Loc)
Depending on wither the location corresponds to a macro, return either the macro name or the token sp...
const LangOptions & getLangOpts() const
bool inTopFrame() const
Return true if the current LocationContext has no caller context.
const LocationContext * getLocationContext() const
const bool wasInlined
If we are post visiting a call, this flag will be set if the call was inlined.
ExplodedNode * generateNonFatalErrorNode(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
Generate a transition to a node that will be used to report an error.
StoreManager & getStoreManager()
const NoteTag * getNoteTag(std::function< std::string(PathSensitiveBugReport &)> &&Cb, bool IsPrunable=false)
A shorthand version of getNoteTag that doesn't require you to accept the 'BugReporterContext' argumen...
static bool isHardenedVariantOf(const FunctionDecl *FD, StringRef Name)
In builds that use source hardening (-D_FORTIFY_SOURCE), many standard functions are implemented as m...
void emitReport(std::unique_ptr< BugReport > R)
Emit the diagnostics report.
unsigned getBlockID() const
Get the blockID.
const DataTagType * make(Args &&... ConstructorArgs)
Definition: BugReporter.h:764
const ProgramStateRef & getState() const
ProgramPoint getLocation() const
getLocation - Returns the edge associated with the given node.
const StackFrameContext * getStackFrame() const
SVal getSVal(const Stmt *S) const
Get the value of an arbitrary expression at this node.
const LocationContext * getLocationContext() const
ProgramStateManager & getStateManager()
Definition: ExprEngine.h:410
ASTContext & getContext() const
getContext - Return the ASTContext associated with this analysis.
Definition: ExprEngine.h:196
StoreManager & getStoreManager()
Definition: ExprEngine.h:412
BugReporter & getBugReporter()
Definition: ExprEngine.h:210
ConstraintManager & getConstraintManager()
Definition: ExprEngine.h:414
DataTag::Factory & getDataTags()
Definition: ExprEngine.h:426
AnalysisManager & getAnalysisManager()
Definition: ExprEngine.h:198
SValBuilder & getSValBuilder()
Definition: ExprEngine.h:208
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:97
const CFGBlock * getBlock() const
Return the CFGBlock associated with this builder.
Definition: CoreEngine.h:209
unsigned blockCount() const
Returns the number of times the current basic block has been visited on the exploded graph path.
Definition: CoreEngine.h:216
This is the simplest builder which generates nodes in the ExplodedGraph.
Definition: CoreEngine.h:232
ExplodedNode * generateNode(const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred)
Generates a node in the ExplodedGraph.
Definition: CoreEngine.h:285
ExplodedNode * generateSink(const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred)
Generates a sink in the ExplodedGraph.
Definition: CoreEngine.h:298
const NodeBuilderContext & getContext()
Definition: CoreEngine.h:324
The tag upon which the TagVisitor reacts.
Definition: BugReporter.h:779
std::function< std::string(BugReporterContext &, PathSensitiveBugReport &)> Callback
Definition: BugReporter.h:782
SymbolManager & getSymbolManager()
Definition: SValBuilder.h:164
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
Definition: SVals.h:55
@ OS
Indicates that the tracking object is a descendant of a referenced-counted OSObject,...
The JSON file list parser is used to communicate input to InstallAPI.
#define false
Definition: stdbool.h:26