clang  16.0.0git
CheckerManager.h
Go to the documentation of this file.
1 //===- CheckerManager.h - Static Analyzer Checker Manager -------*- C++ -*-===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // Defines the Static Analyzer Checker Manager.
10 //
11 //===----------------------------------------------------------------------===//
12 
13 #ifndef LLVM_CLANG_STATICANALYZER_CORE_CHECKERMANAGER_H
14 #define LLVM_CLANG_STATICANALYZER_CORE_CHECKERMANAGER_H
15 
17 #include "clang/Basic/Diagnostic.h"
21 #include "llvm/ADT/ArrayRef.h"
22 #include "llvm/ADT/DenseMap.h"
23 #include "llvm/ADT/SmallVector.h"
24 #include "llvm/ADT/StringRef.h"
25 #include <vector>
26 
27 namespace clang {
28 
29 class AnalyzerOptions;
30 class CallExpr;
31 class Decl;
32 class LocationContext;
33 class Stmt;
34 class TranslationUnitDecl;
35 
36 namespace ento {
37 
38 class AnalysisManager;
39 class CXXAllocatorCall;
40 class BugReporter;
41 class CallEvent;
42 class CheckerBase;
43 class CheckerContext;
44 class CheckerRegistry;
45 struct CheckerRegistryData;
46 class ExplodedGraph;
47 class ExplodedNode;
48 class ExplodedNodeSet;
49 class ExprEngine;
50 struct EvalCallOptions;
51 class MemRegion;
52 struct NodeBuilderContext;
53 class ObjCMethodCall;
54 class RegionAndSymbolInvalidationTraits;
55 class SVal;
56 class SymbolReaper;
57 
58 template <typename T> class CheckerFn;
59 
60 template <typename RET, typename... Ps>
61 class CheckerFn<RET(Ps...)> {
62  using Func = RET (*)(void *, Ps...);
63 
64  Func Fn;
65 
66 public:
68 
69  CheckerFn(CheckerBase *checker, Func fn) : Fn(fn), Checker(checker) {}
70 
71  RET operator()(Ps... ps) const {
72  return Fn(Checker, ps...);
73  }
74 };
75 
76 /// Describes the different reasons a pointer escapes
77 /// during analysis.
79  /// A pointer escapes due to binding its value to a location
80  /// that the analyzer cannot track.
82 
83  /// The pointer has been passed to a function call directly.
85 
86  /// The pointer has been passed to a function indirectly.
87  /// For example, the pointer is accessible through an
88  /// argument to a function.
90 
91 
92  /// Escape for a new symbol that was generated into a region
93  /// that the analyzer cannot follow during a conservative call.
95 
96  /// The reason for pointer escape is unknown. For example,
97  /// a region containing this pointer is invalidated.
99 };
100 
101 /// This wrapper is used to ensure that only StringRefs originating from the
102 /// CheckerRegistry are used as check names. We want to make sure all checker
103 /// name strings have a lifetime that keeps them alive at least until the path
104 /// diagnostics have been processed, since they are expected to be constexpr
105 /// string literals (most likely generated by TblGen).
107  friend class ::clang::ento::CheckerRegistry;
108 
109  StringRef Name;
110 
111  explicit CheckerNameRef(StringRef Name) : Name(Name) {}
112 
113 public:
114  CheckerNameRef() = default;
115 
116  StringRef getName() const { return Name; }
117  operator StringRef() const { return Name; }
118 };
119 
121  Pre,
122  Post,
123  MessageNil
124 };
125 
127  ASTContext *Context = nullptr;
128  const LangOptions LangOpts;
129  const AnalyzerOptions &AOptions;
130  const Preprocessor *PP = nullptr;
131  CheckerNameRef CurrentCheckerName;
132  DiagnosticsEngine &Diags;
133  std::unique_ptr<CheckerRegistryData> RegistryData;
134 
135 public:
136  // These constructors are defined in the Frontend library, because
137  // CheckerRegistry, a crucial component of the initialization is in there.
138  // CheckerRegistry cannot be moved to the Core library, because the checker
139  // registration functions are defined in the Checkers library, and the library
140  // dependencies look like this: Core -> Checkers -> Frontend.
141 
143  ASTContext &Context, AnalyzerOptions &AOptions, const Preprocessor &PP,
144  ArrayRef<std::string> plugins,
145  ArrayRef<std::function<void(CheckerRegistry &)>> checkerRegistrationFns);
146 
147  /// Constructs a CheckerManager that ignores all non TblGen-generated
148  /// checkers. Useful for unit testing, unless the checker infrastructure
149  /// itself is tested.
151  const Preprocessor &PP)
152  : CheckerManager(Context, AOptions, PP, {}, {}) {}
153 
154  /// Constructs a CheckerManager without requiring an AST. No checker
155  /// registration will take place. Only useful when one needs to print the
156  /// help flags through CheckerRegistryData, and the AST is unavailable.
157  CheckerManager(AnalyzerOptions &AOptions, const LangOptions &LangOpts,
158  DiagnosticsEngine &Diags, ArrayRef<std::string> plugins);
159 
160  ~CheckerManager();
161 
162  void setCurrentCheckerName(CheckerNameRef name) { CurrentCheckerName = name; }
163  CheckerNameRef getCurrentCheckerName() const { return CurrentCheckerName; }
164 
165  bool hasPathSensitiveCheckers() const;
166 
168 
169  const LangOptions &getLangOpts() const { return LangOpts; }
170  const AnalyzerOptions &getAnalyzerOptions() const { return AOptions; }
171  const Preprocessor &getPreprocessor() const {
172  assert(PP);
173  return *PP;
174  }
176  return *RegistryData;
177  }
178  DiagnosticsEngine &getDiagnostics() const { return Diags; }
180  assert(Context);
181  return *Context;
182  }
183 
184  /// Emits an error through a DiagnosticsEngine about an invalid user supplied
185  /// checker option value.
187  StringRef OptionName,
188  StringRef ExpectedValueDesc) const;
189 
191  using CheckerTag = const void *;
192  using CheckerDtor = CheckerFn<void ()>;
193 
194 //===----------------------------------------------------------------------===//
195 // Checker registration.
196 //===----------------------------------------------------------------------===//
197 
198  /// Used to register checkers.
199  /// All arguments are automatically passed through to the checker
200  /// constructor.
201  ///
202  /// \returns a pointer to the checker object.
203  template <typename CHECKER, typename... AT>
204  CHECKER *registerChecker(AT &&... Args) {
205  CheckerTag tag = getTag<CHECKER>();
206  CheckerRef &ref = CheckerTags[tag];
207  assert(!ref && "Checker already registered, use getChecker!");
208 
209  CHECKER *checker = new CHECKER(std::forward<AT>(Args)...);
210  checker->Name = CurrentCheckerName;
211  CheckerDtors.push_back(CheckerDtor(checker, destruct<CHECKER>));
212  CHECKER::_register(checker, *this);
213  ref = checker;
214  return checker;
215  }
216 
217  template <typename CHECKER>
219  CheckerTag tag = getTag<CHECKER>();
220  assert(CheckerTags.count(tag) != 0 &&
221  "Requested checker is not registered! Maybe you should add it as a "
222  "dependency in Checkers.td?");
223  return static_cast<CHECKER *>(CheckerTags[tag]);
224  }
225 
226 //===----------------------------------------------------------------------===//
227 // Functions for running checkers for AST traversing.
228 //===----------------------------------------------------------------------===//
229 
230  /// Run checkers handling Decls.
231  void runCheckersOnASTDecl(const Decl *D, AnalysisManager& mgr,
232  BugReporter &BR);
233 
234  /// Run checkers handling Decls containing a Stmt body.
235  void runCheckersOnASTBody(const Decl *D, AnalysisManager& mgr,
236  BugReporter &BR);
237 
238 //===----------------------------------------------------------------------===//
239 // Functions for running checkers for path-sensitive checking.
240 //===----------------------------------------------------------------------===//
241 
242  /// Run checkers for pre-visiting Stmts.
243  ///
244  /// The notification is performed for every explored CFGElement, which does
245  /// not include the control flow statements such as IfStmt.
246  ///
247  /// \sa runCheckersForBranchCondition, runCheckersForPostStmt
249  const ExplodedNodeSet &Src,
250  const Stmt *S,
251  ExprEngine &Eng) {
252  runCheckersForStmt(/*isPreVisit=*/true, Dst, Src, S, Eng);
253  }
254 
255  /// Run checkers for post-visiting Stmts.
256  ///
257  /// The notification is performed for every explored CFGElement, which does
258  /// not include the control flow statements such as IfStmt.
259  ///
260  /// \sa runCheckersForBranchCondition, runCheckersForPreStmt
262  const ExplodedNodeSet &Src,
263  const Stmt *S,
264  ExprEngine &Eng,
265  bool wasInlined = false) {
266  runCheckersForStmt(/*isPreVisit=*/false, Dst, Src, S, Eng, wasInlined);
267  }
268 
269  /// Run checkers for visiting Stmts.
270  void runCheckersForStmt(bool isPreVisit,
271  ExplodedNodeSet &Dst, const ExplodedNodeSet &Src,
272  const Stmt *S, ExprEngine &Eng,
273  bool wasInlined = false);
274 
275  /// Run checkers for pre-visiting obj-c messages.
277  const ExplodedNodeSet &Src,
278  const ObjCMethodCall &msg,
279  ExprEngine &Eng) {
281  }
282 
283  /// Run checkers for post-visiting obj-c messages.
285  const ExplodedNodeSet &Src,
286  const ObjCMethodCall &msg,
287  ExprEngine &Eng,
288  bool wasInlined = false) {
290  wasInlined);
291  }
292 
293  /// Run checkers for visiting an obj-c message to nil.
295  const ExplodedNodeSet &Src,
296  const ObjCMethodCall &msg,
297  ExprEngine &Eng) {
299  Eng);
300  }
301 
302  /// Run checkers for visiting obj-c messages.
304  ExplodedNodeSet &Dst,
305  const ExplodedNodeSet &Src,
306  const ObjCMethodCall &msg, ExprEngine &Eng,
307  bool wasInlined = false);
308 
309  /// Run checkers for pre-visiting obj-c messages.
311  const CallEvent &Call, ExprEngine &Eng) {
312  runCheckersForCallEvent(/*isPreVisit=*/true, Dst, Src, Call, Eng);
313  }
314 
315  /// Run checkers for post-visiting obj-c messages.
317  const CallEvent &Call, ExprEngine &Eng,
318  bool wasInlined = false) {
319  runCheckersForCallEvent(/*isPreVisit=*/false, Dst, Src, Call, Eng,
320  wasInlined);
321  }
322 
323  /// Run checkers for visiting obj-c messages.
324  void runCheckersForCallEvent(bool isPreVisit, ExplodedNodeSet &Dst,
325  const ExplodedNodeSet &Src,
326  const CallEvent &Call, ExprEngine &Eng,
327  bool wasInlined = false);
328 
329  /// Run checkers for load/store of a location.
331  const ExplodedNodeSet &Src,
332  SVal location,
333  bool isLoad,
334  const Stmt *NodeEx,
335  const Stmt *BoundEx,
336  ExprEngine &Eng);
337 
338  /// Run checkers for binding of a value to a location.
340  const ExplodedNodeSet &Src,
341  SVal location, SVal val,
342  const Stmt *S, ExprEngine &Eng,
343  const ProgramPoint &PP);
344 
345  /// Run checkers for end of analysis.
347  ExprEngine &Eng);
348 
349  /// Run checkers on beginning of function.
351  const BlockEdge &L,
352  ExplodedNode *Pred,
353  ExprEngine &Eng);
354 
355  /// Run checkers on end of function.
357  ExplodedNodeSet &Dst,
358  ExplodedNode *Pred,
359  ExprEngine &Eng,
360  const ReturnStmt *RS);
361 
362  /// Run checkers for branch condition.
363  void runCheckersForBranchCondition(const Stmt *condition,
364  ExplodedNodeSet &Dst, ExplodedNode *Pred,
365  ExprEngine &Eng);
366 
367  /// Run checkers between C++ operator new and constructor calls.
369  ExplodedNodeSet &Dst, ExplodedNode *Pred,
370  ExprEngine &Eng, bool wasInlined = false);
371 
372  /// Run checkers for live symbols.
373  ///
374  /// Allows modifying SymbolReaper object. For example, checkers can explicitly
375  /// register symbols of interest as live. These symbols will not be marked
376  /// dead and removed.
378  SymbolReaper &SymReaper);
379 
380  /// Run checkers for dead symbols.
381  ///
382  /// Notifies checkers when symbols become dead. For example, this allows
383  /// checkers to aggressively clean up/reduce the checker state and produce
384  /// precise diagnostics.
386  const ExplodedNodeSet &Src,
387  SymbolReaper &SymReaper, const Stmt *S,
388  ExprEngine &Eng,
390 
391  /// Run checkers for region changes.
392  ///
393  /// This corresponds to the check::RegionChanges callback.
394  /// \param state The current program state.
395  /// \param invalidated A set of all symbols potentially touched by the change.
396  /// \param ExplicitRegions The regions explicitly requested for invalidation.
397  /// For example, in the case of a function call, these would be arguments.
398  /// \param Regions The transitive closure of accessible regions,
399  /// i.e. all regions that may have been touched by this change.
400  /// \param Call The call expression wrapper if the regions are invalidated
401  /// by a call.
404  const InvalidatedSymbols *invalidated,
405  ArrayRef<const MemRegion *> ExplicitRegions,
407  const LocationContext *LCtx,
408  const CallEvent *Call);
409 
410  /// Run checkers when pointers escape.
411  ///
412  /// This notifies the checkers about pointer escape, which occurs whenever
413  /// the analyzer cannot track the symbol any more. For example, as a
414  /// result of assigning a pointer into a global or when it's passed to a
415  /// function call the analyzer cannot model.
416  ///
417  /// \param State The state at the point of escape.
418  /// \param Escaped The list of escaped symbols.
419  /// \param Call The corresponding CallEvent, if the symbols escape as
420  /// parameters to the given call.
421  /// \param Kind The reason of pointer escape.
422  /// \param ITraits Information about invalidation for a particular
423  /// region/symbol.
424  /// \returns Checkers can modify the state by returning a new one.
427  const InvalidatedSymbols &Escaped,
428  const CallEvent *Call,
431 
432  /// Run checkers for handling assumptions on symbolic values.
434  SVal Cond, bool Assumption);
435 
436  /// Run checkers for evaluating a call.
437  ///
438  /// Warning: Currently, the CallEvent MUST come from a CallExpr!
440  const CallEvent &CE, ExprEngine &Eng,
441  const EvalCallOptions &CallOpts);
442 
443  /// Run checkers for the entire Translation Unit.
445  AnalysisManager &mgr,
446  BugReporter &BR);
447 
448  /// Run checkers for debug-printing a ProgramState.
449  ///
450  /// Unlike most other callbacks, any checker can simply implement the virtual
451  /// method CheckerBase::printState if it has custom data to print.
452  ///
453  /// \param Out The output stream
454  /// \param State The state being printed
455  /// \param NL The preferred representation of a newline.
456  /// \param Space The preferred space between the left side and the message.
457  /// \param IsDot Whether the message will be printed in 'dot' format.
458  void runCheckersForPrintStateJson(raw_ostream &Out, ProgramStateRef State,
459  const char *NL = "\n",
460  unsigned int Space = 0,
461  bool IsDot = false) const;
462 
463  //===----------------------------------------------------------------------===//
464  // Internal registration functions for AST traversing.
465  //===----------------------------------------------------------------------===//
466 
467  // Functions used by the registration mechanism, checkers should not touch
468  // these directly.
469 
470  using CheckDeclFunc =
472 
473  using HandlesDeclFunc = bool (*)(const Decl *D);
474 
475  void _registerForDecl(CheckDeclFunc checkfn, HandlesDeclFunc isForDeclFn);
476 
477  void _registerForBody(CheckDeclFunc checkfn);
478 
479 //===----------------------------------------------------------------------===//
480 // Internal registration functions for path-sensitive checking.
481 //===----------------------------------------------------------------------===//
482 
483  using CheckStmtFunc = CheckerFn<void (const Stmt *, CheckerContext &)>;
484 
485  using CheckObjCMessageFunc =
487 
488  using CheckCallFunc =
489  CheckerFn<void (const CallEvent &, CheckerContext &)>;
490 
491  using CheckLocationFunc =
492  CheckerFn<void (const SVal &location, bool isLoad, const Stmt *S,
494 
495  using CheckBindFunc =
496  CheckerFn<void (const SVal &location, const SVal &val, const Stmt *S,
498 
499  using CheckEndAnalysisFunc =
501 
503 
504  using CheckEndFunctionFunc =
505  CheckerFn<void (const ReturnStmt *, CheckerContext &)>;
506 
508  CheckerFn<void (const Stmt *, CheckerContext &)>;
509 
510  using CheckNewAllocatorFunc =
512 
513  using CheckDeadSymbolsFunc =
515 
517 
518  using CheckRegionChangesFunc =
520  const InvalidatedSymbols *symbols,
521  ArrayRef<const MemRegion *> ExplicitRegions,
523  const LocationContext *LCtx,
524  const CallEvent *Call)>;
525 
526  using CheckPointerEscapeFunc =
528  const InvalidatedSymbols &Escaped,
529  const CallEvent *Call, PointerEscapeKind Kind,
531 
532  using EvalAssumeFunc =
534  bool assumption)>;
535 
537 
541 
542  using HandlesStmtFunc = bool (*)(const Stmt *D);
543 
544  void _registerForPreStmt(CheckStmtFunc checkfn,
545  HandlesStmtFunc isForStmtFn);
546  void _registerForPostStmt(CheckStmtFunc checkfn,
547  HandlesStmtFunc isForStmtFn);
548 
551 
553 
554  void _registerForPreCall(CheckCallFunc checkfn);
555  void _registerForPostCall(CheckCallFunc checkfn);
556 
558 
559  void _registerForBind(CheckBindFunc checkfn);
560 
562 
565 
567 
569 
571 
573 
575 
577 
579 
581 
582  void _registerForEvalCall(EvalCallFunc checkfn);
583 
585 
586 //===----------------------------------------------------------------------===//
587 // Internal registration functions for events.
588 //===----------------------------------------------------------------------===//
589 
590  using EventTag = void *;
591  using CheckEventFunc = CheckerFn<void (const void *event)>;
592 
593  template <typename EVENT>
595  EventInfo &info = Events[&EVENT::Tag];
596  info.Checkers.push_back(checkfn);
597  }
598 
599  template <typename EVENT>
601  EventInfo &info = Events[&EVENT::Tag];
602  info.HasDispatcher = true;
603  }
604 
605  template <typename EVENT>
606  void _dispatchEvent(const EVENT &event) const {
607  EventsTy::const_iterator I = Events.find(&EVENT::Tag);
608  if (I == Events.end())
609  return;
610  const EventInfo &info = I->second;
611  for (const auto &Checker : info.Checkers)
612  Checker(&event);
613  }
614 
615 //===----------------------------------------------------------------------===//
616 // Implementation details.
617 //===----------------------------------------------------------------------===//
618 
619 private:
620  template <typename CHECKER>
621  static void destruct(void *obj) { delete static_cast<CHECKER *>(obj); }
622 
623  template <typename T>
624  static void *getTag() { static int tag; return &tag; }
625 
626  llvm::DenseMap<CheckerTag, CheckerRef> CheckerTags;
627 
628  std::vector<CheckerDtor> CheckerDtors;
629 
630  struct DeclCheckerInfo {
631  CheckDeclFunc CheckFn;
632  HandlesDeclFunc IsForDeclFn;
633  };
634  std::vector<DeclCheckerInfo> DeclCheckers;
635 
636  std::vector<CheckDeclFunc> BodyCheckers;
637 
638  using CachedDeclCheckers = SmallVector<CheckDeclFunc, 4>;
639  using CachedDeclCheckersMapTy = llvm::DenseMap<unsigned, CachedDeclCheckers>;
640  CachedDeclCheckersMapTy CachedDeclCheckersMap;
641 
642  struct StmtCheckerInfo {
643  CheckStmtFunc CheckFn;
644  HandlesStmtFunc IsForStmtFn;
645  bool IsPreVisit;
646  };
647  std::vector<StmtCheckerInfo> StmtCheckers;
648 
649  using CachedStmtCheckers = SmallVector<CheckStmtFunc, 4>;
650  using CachedStmtCheckersMapTy = llvm::DenseMap<unsigned, CachedStmtCheckers>;
651  CachedStmtCheckersMapTy CachedStmtCheckersMap;
652 
653  const CachedStmtCheckers &getCachedStmtCheckersFor(const Stmt *S,
654  bool isPreVisit);
655 
656  /// Returns the checkers that have registered for callbacks of the
657  /// given \p Kind.
658  const std::vector<CheckObjCMessageFunc> &
659  getObjCMessageCheckers(ObjCMessageVisitKind Kind) const;
660 
661  std::vector<CheckObjCMessageFunc> PreObjCMessageCheckers;
662  std::vector<CheckObjCMessageFunc> PostObjCMessageCheckers;
663  std::vector<CheckObjCMessageFunc> ObjCMessageNilCheckers;
664 
665  std::vector<CheckCallFunc> PreCallCheckers;
666  std::vector<CheckCallFunc> PostCallCheckers;
667 
668  std::vector<CheckLocationFunc> LocationCheckers;
669 
670  std::vector<CheckBindFunc> BindCheckers;
671 
672  std::vector<CheckEndAnalysisFunc> EndAnalysisCheckers;
673 
674  std::vector<CheckBeginFunctionFunc> BeginFunctionCheckers;
675  std::vector<CheckEndFunctionFunc> EndFunctionCheckers;
676 
677  std::vector<CheckBranchConditionFunc> BranchConditionCheckers;
678 
679  std::vector<CheckNewAllocatorFunc> NewAllocatorCheckers;
680 
681  std::vector<CheckLiveSymbolsFunc> LiveSymbolsCheckers;
682 
683  std::vector<CheckDeadSymbolsFunc> DeadSymbolsCheckers;
684 
685  std::vector<CheckRegionChangesFunc> RegionChangesCheckers;
686 
687  std::vector<CheckPointerEscapeFunc> PointerEscapeCheckers;
688 
689  std::vector<EvalAssumeFunc> EvalAssumeCheckers;
690 
691  std::vector<EvalCallFunc> EvalCallCheckers;
692 
693  std::vector<CheckEndOfTranslationUnit> EndOfTranslationUnitCheckers;
694 
695  struct EventInfo {
696  SmallVector<CheckEventFunc, 4> Checkers;
697  bool HasDispatcher = false;
698 
699  EventInfo() = default;
700  };
701 
702  using EventsTy = llvm::DenseMap<EventTag, EventInfo>;
703  EventsTy Events;
704 };
705 
706 } // namespace ento
707 
708 } // namespace clang
709 
710 #endif // LLVM_CLANG_STATICANALYZER_CORE_CHECKERMANAGER_H
clang::ento::CheckerManager::runCheckersForObjCMessageNil
void runCheckersForObjCMessageNil(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const ObjCMethodCall &msg, ExprEngine &Eng)
Run checkers for visiting an obj-c message to nil.
Definition: CheckerManager.h:294
clang::ento::CheckerManager::runCheckersOnASTBody
void runCheckersOnASTBody(const Decl *D, AnalysisManager &mgr, BugReporter &BR)
Run checkers handling Decls containing a Stmt body.
Definition: CheckerManager.cpp:98
clang::ento::PSK_DirectEscapeOnCall
@ PSK_DirectEscapeOnCall
The pointer has been passed to a function call directly.
Definition: CheckerManager.h:84
clang::LocationContext
It wraps the AnalysisDeclContext to represent both the call stack with the help of StackFrameContext ...
Definition: AnalysisDeclContext.h:215
clang::ento::CheckerManager::runCheckersForPreObjCMessage
void runCheckersForPreObjCMessage(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const ObjCMethodCall &msg, ExprEngine &Eng)
Run checkers for pre-visiting obj-c messages.
Definition: CheckerManager.h:276
clang::ento::CheckerManager::runCheckersForBeginFunction
void runCheckersForBeginFunction(ExplodedNodeSet &Dst, const BlockEdge &L, ExplodedNode *Pred, ExprEngine &Eng)
Run checkers on beginning of function.
Definition: CheckerManager.cpp:436
clang::ento::CheckerManager::_registerForConstPointerEscape
void _registerForConstPointerEscape(CheckPointerEscapeFunc checkfn)
Definition: CheckerManager.cpp:885
clang::ento::CheckerManager::registerChecker
CHECKER * registerChecker(AT &&... Args)
Used to register checkers.
Definition: CheckerManager.h:204
clang::ento::CheckerManager::getCurrentCheckerName
CheckerNameRef getCurrentCheckerName() const
Definition: CheckerManager.h:163
clang::RISCV::TU
@ TU
Definition: RISCVVIntrinsicUtils.h:95
clang::ento::CheckerRegistryData
Definition: CheckerRegistryData.h:193
clang::ento::CheckerManager::runCheckersForLiveSymbols
void runCheckersForLiveSymbols(ProgramStateRef state, SymbolReaper &SymReaper)
Run checkers for live symbols.
Definition: CheckerManager.cpp:546
clang::ento::CheckerManager::getLangOpts
const LangOptions & getLangOpts() const
Definition: CheckerManager.h:169
clang::ento::CheckerFn< RET(Ps...)>::operator()
RET operator()(Ps... ps) const
Definition: CheckerManager.h:71
clang::ento::CheckerManager::_registerForBranchCondition
void _registerForBranchCondition(CheckBranchConditionFunc checkfn)
Definition: CheckerManager.cpp:860
clang::ento::ProgramStateRef
IntrusiveRefCntPtr< const ProgramState > ProgramStateRef
Definition: ProgramState_Fwd.h:37
clang::ento::CheckerManager::getAnalyzerOptions
const AnalyzerOptions & getAnalyzerOptions() const
Definition: CheckerManager.h:170
clang::ento::CheckerManager::runCheckersForObjCMessage
void runCheckersForObjCMessage(ObjCMessageVisitKind visitKind, ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const ObjCMethodCall &msg, ExprEngine &Eng, bool wasInlined=false)
Run checkers for visiting obj-c messages.
Definition: CheckerManager.cpp:240
clang::ento::ObjCMessageVisitKind::Pre
@ Pre
clang::ento::CheckerManager::runCheckersForRegionChanges
ProgramStateRef runCheckersForRegionChanges(ProgramStateRef state, const InvalidatedSymbols *invalidated, ArrayRef< const MemRegion * > ExplicitRegions, ArrayRef< const MemRegion * > Regions, const LocationContext *LCtx, const CallEvent *Call)
Run checkers for region changes.
Definition: CheckerManager.cpp:599
clang::ento::ExplodedNode
Definition: ExplodedGraph.h:65
clang::ento::CheckerManager::runCheckersForEndFunction
void runCheckersForEndFunction(NodeBuilderContext &BC, ExplodedNodeSet &Dst, ExplodedNode *Pred, ExprEngine &Eng, const ReturnStmt *RS)
Run checkers on end of function.
Definition: CheckerManager.cpp:449
clang::DiagnosticsEngine
Concrete class used by the front-end to report problems and issues.
Definition: Diagnostic.h:192
clang::ento::CheckerManager::CheckerDtor
CheckerFn< void()> CheckerDtor
Definition: CheckerManager.h:192
clang::ento::CheckerManager::runCheckersForEvalCall
void runCheckersForEvalCall(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const CallEvent &CE, ExprEngine &Eng, const EvalCallOptions &CallOpts)
Run checkers for evaluating a call.
Definition: CheckerManager.cpp:653
ProgramState_Fwd.h
clang::ento::CheckerManager::EventTag
void * EventTag
Definition: CheckerManager.h:590
clang::ento::CheckerManager::runCheckersForBranchCondition
void runCheckersForBranchCondition(const Stmt *condition, ExplodedNodeSet &Dst, ExplodedNode *Pred, ExprEngine &Eng)
Run checkers for branch condition.
Definition: CheckerManager.cpp:494
clang::ento::CheckerManager::_registerForRegionChanges
void _registerForRegionChanges(CheckRegionChangesFunc checkfn)
Definition: CheckerManager.cpp:877
clang::ento::CheckerManager::_registerForObjCMessageNil
void _registerForObjCMessageNil(CheckObjCMessageFunc checkfn)
Definition: CheckerManager.cpp:825
clang::ento::CheckerManager::_registerForBody
void _registerForBody(CheckDeclFunc checkfn)
Definition: CheckerManager.cpp:801
clang::ento::CheckerManager::runCheckersForPostCall
void runCheckersForPostCall(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const CallEvent &Call, ExprEngine &Eng, bool wasInlined=false)
Run checkers for post-visiting obj-c messages.
Definition: CheckerManager.h:316
clang::ento::CheckerManager::runCheckersForPrintStateJson
void runCheckersForPrintStateJson(raw_ostream &Out, ProgramStateRef State, const char *NL="\n", unsigned int Space=0, bool IsDot=false) const
Run checkers for debug-printing a ProgramState.
Definition: CheckerManager.cpp:722
clang::ento::CheckerManager::setCurrentCheckerName
void setCurrentCheckerName(CheckerNameRef name)
Definition: CheckerManager.h:162
clang::ento::CheckerManager::getCheckerRegistryData
const CheckerRegistryData & getCheckerRegistryData() const
Definition: CheckerManager.h:175
clang::ento::CheckerManager::_dispatchEvent
void _dispatchEvent(const EVENT &event) const
Definition: CheckerManager.h:606
clang::ento::CheckerManager::_registerForBind
void _registerForBind(CheckBindFunc checkfn)
Definition: CheckerManager.cpp:844
clang::CodeGen::AlignmentSource::Decl
@ Decl
The l-value was an access to a declared entity or something equivalently strong, like the address of ...
clang::ento::CheckerManager::runCheckersForEndAnalysis
void runCheckersForEndAnalysis(ExplodedGraph &G, BugReporter &BR, ExprEngine &Eng)
Run checkers for end of analysis.
Definition: CheckerManager.cpp:402
clang::ento::CheckerNameRef::CheckerNameRef
CheckerNameRef()=default
clang::TranslationUnitDecl
The top declaration context.
Definition: Decl.h:80
clang::ento::EvalCallOptions
Hints for figuring out of a call should be inlined during evalCall().
Definition: ExprEngine.h:96
ProgramPoint.h
clang::ento::CheckerManager::CheckStmtFunc
CheckerFn< void(const Stmt *, CheckerContext &)> CheckStmtFunc
Definition: CheckerManager.h:483
clang::ento::CheckerManager::_registerForPointerEscape
void _registerForPointerEscape(CheckPointerEscapeFunc checkfn)
Definition: CheckerManager.cpp:881
clang::ASTContext
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:209
CHECKER
#define CHECKER(FULLNAME, CLASS, HELPTEXT, DOC_URI, IS_HIDDEN)
Definition: BuiltinCheckerRegistration.h:25
LangOptions.h
Diagnostic.h
clang::ento::CheckerManager::_registerForEndOfTranslationUnit
void _registerForEndOfTranslationUnit(CheckEndOfTranslationUnit checkfn)
Definition: CheckerManager.cpp:898
clang::ento::CheckerManager::hasPathSensitiveCheckers
bool hasPathSensitiveCheckers() const
Definition: CheckerManager.cpp:36
clang::ento::ObjCMessageVisitKind
ObjCMessageVisitKind
Definition: CheckerManager.h:120
Store.h
clang::ento::PSK_EscapeOutParameters
@ PSK_EscapeOutParameters
Escape for a new symbol that was generated into a region that the analyzer cannot follow during a con...
Definition: CheckerManager.h:94
clang::ento::CheckerManager::_registerForEvalCall
void _registerForEvalCall(EvalCallFunc checkfn)
Definition: CheckerManager.cpp:894
clang::ento::CheckerManager::runCheckersForNewAllocator
void runCheckersForNewAllocator(const CXXAllocatorCall &Call, ExplodedNodeSet &Dst, ExplodedNode *Pred, ExprEngine &Eng, bool wasInlined=false)
Run checkers between C++ operator new and constructor calls.
Definition: CheckerManager.cpp:534
clang::ento::CheckerManager::CheckerTag
const void * CheckerTag
Definition: CheckerManager.h:191
clang::ento::CheckerManager::runCheckersForStmt
void runCheckersForStmt(bool isPreVisit, ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng, bool wasInlined=false)
Run checkers for visiting Stmts.
Definition: CheckerManager.cpp:184
clang::ento::CheckerNameRef
This wrapper is used to ensure that only StringRefs originating from the CheckerRegistry are used as ...
Definition: CheckerManager.h:106
clang::ento::CheckerManager::_registerForLocation
void _registerForLocation(CheckLocationFunc checkfn)
Definition: CheckerManager.cpp:840
bool
#define bool
Definition: stdbool.h:20
clang::ento::CXXAllocatorCall
Represents the memory allocation call in a C++ new-expression.
Definition: CallEvent.h:999
clang::ento::CheckerManager::_registerForPreStmt
void _registerForPreStmt(CheckStmtFunc checkfn, HandlesStmtFunc isForStmtFn)
Definition: CheckerManager.cpp:809
clang::ento::SymbolReaper
A class responsible for cleaning up unused symbols.
Definition: SymbolManager.h:572
llvm::DenseSet< SymbolRef >
clang::ento::CheckerManager::_registerForNewAllocator
void _registerForNewAllocator(CheckNewAllocatorFunc checkfn)
Definition: CheckerManager.cpp:865
clang::ento::CheckerManager::runCheckersForCallEvent
void runCheckersForCallEvent(bool isPreVisit, ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const CallEvent &Call, ExprEngine &Eng, bool wasInlined=false)
Run checkers for visiting obj-c messages.
Definition: CheckerManager.cpp:298
clang::ento::BugReporter
BugReporter is a utility class for generating PathDiagnostics for analysis.
Definition: BugReporter.h:585
clang::ento::ExplodedGraph
Definition: ExplodedGraph.h:302
clang::ento::CheckerManager::_registerForPreCall
void _registerForPreCall(CheckCallFunc checkfn)
Definition: CheckerManager.cpp:833
clang::ento::ObjCMessageVisitKind::Post
@ Post
clang::ento::CheckerManager::runCheckersForPreCall
void runCheckersForPreCall(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const CallEvent &Call, ExprEngine &Eng)
Run checkers for pre-visiting obj-c messages.
Definition: CheckerManager.h:310
state
and static some checkers Checker The latter are built on top of the former via the Checker and CheckerVisitor and attempts to isolate them from much of the gore of the internal analysis the analyzer is basically a source code simulator that traces out possible paths of execution The state of the and the combination of state and program point is a node in an exploded which has the entry program point and initial state
Definition: README.txt:30
clang::ento::CheckerManager::_registerForPostStmt
void _registerForPostStmt(CheckStmtFunc checkfn, HandlesStmtFunc isForStmtFn)
Definition: CheckerManager.cpp:815
clang::ento::CheckerManager::getASTContext
ASTContext & getASTContext() const
Definition: CheckerManager.h:179
clang::ento::CheckerManager::getChecker
CHECKER * getChecker()
Definition: CheckerManager.h:218
clang::ento::CheckerManager::getPreprocessor
const Preprocessor & getPreprocessor() const
Definition: CheckerManager.h:171
clang::ento::PSK_EscapeOther
@ PSK_EscapeOther
The reason for pointer escape is unknown.
Definition: CheckerManager.h:98
clang::ento::CheckerManager::getDiagnostics
DiagnosticsEngine & getDiagnostics() const
Definition: CheckerManager.h:178
clang::ento::CheckerManager::_registerForPostObjCMessage
void _registerForPostObjCMessage(CheckObjCMessageFunc checkfn)
Definition: CheckerManager.cpp:829
clang::ento::CheckerManager::HandlesStmtFunc
bool(*)(const Stmt *D) HandlesStmtFunc
Definition: CheckerManager.h:542
clang::ProgramPoint::Kind
Kind
Definition: ProgramPoint.h:60
llvm::ArrayRef< std::string >
clang::ento::CheckerManager::runCheckersForPostStmt
void runCheckersForPostStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng, bool wasInlined=false)
Run checkers for post-visiting Stmts.
Definition: CheckerManager.h:261
clang::Decl
Decl - This represents one declaration (or definition), e.g.
Definition: DeclBase.h:83
clang::ento::CheckerBase
Definition: Checker.h:492
clang::ento::CheckerManager::_registerForDeadSymbols
void _registerForDeadSymbols(CheckDeadSymbolsFunc checkfn)
Definition: CheckerManager.cpp:873
clang::ento::CheckerManager::runCheckersForLocation
void runCheckersForLocation(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, SVal location, bool isLoad, const Stmt *NodeEx, const Stmt *BoundEx, ExprEngine &Eng)
Run checkers for load/store of a location.
Definition: CheckerManager.cpp:350
clang::AnalyzerOptions
Stores options for the analyzer from the command line.
Definition: AnalyzerOptions.h:150
State
LineState State
Definition: UnwrappedLineFormatter.cpp:1139
clang::ento::CheckerManager::runCheckersForDeadSymbols
void runCheckersForDeadSymbols(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, SymbolReaper &SymReaper, const Stmt *S, ExprEngine &Eng, ProgramPoint::Kind K)
Run checkers for dead symbols.
Definition: CheckerManager.cpp:587
clang::ento::CheckerManager::runCheckersOnASTDecl
void runCheckersOnASTDecl(const Decl *D, AnalysisManager &mgr, BugReporter &BR)
Run checkers handling Decls.
Definition: CheckerManager.cpp:76
clang::ento::ObjCMethodCall
Represents any expression that calls an Objective-C method.
Definition: CallEvent.h:1131
clang::ento::AnalysisManager
Definition: AnalysisManager.h:31
clang::ento::CheckerManager::reportInvalidCheckerOptionValue
void reportInvalidCheckerOptionValue(const CheckerBase *C, StringRef OptionName, StringRef ExpectedValueDesc) const
Emits an error through a DiagnosticsEngine about an invalid user supplied checker option value.
Definition: CheckerManager.cpp:63
clang::ento::PSK_IndirectEscapeOnCall
@ PSK_IndirectEscapeOnCall
The pointer has been passed to a function indirectly.
Definition: CheckerManager.h:89
clang::ento::CheckerManager::_registerForEvalAssume
void _registerForEvalAssume(EvalAssumeFunc checkfn)
Definition: CheckerManager.cpp:890
clang::LangOptions
Keeps track of the various options that can be enabled, which controls the dialect of C or C++ that i...
Definition: LangOptions.h:78
clang::ObjCPropertyAttribute::Kind
Kind
Definition: DeclObjCCommon.h:22
clang::ento::ExprEngine
Definition: ExprEngine.h:123
clang::ento::CheckerManager::runCheckersForPostObjCMessage
void runCheckersForPostObjCMessage(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const ObjCMethodCall &msg, ExprEngine &Eng, bool wasInlined=false)
Run checkers for post-visiting obj-c messages.
Definition: CheckerManager.h:284
clang::ento::CheckerManager::_registerForEndFunction
void _registerForEndFunction(CheckEndFunctionFunc checkfn)
Definition: CheckerManager.cpp:856
clang::ento::CheckerNameRef::getName
StringRef getName() const
Definition: CheckerManager.h:116
clang::ento::CheckerManager
Definition: CheckerManager.h:126
clang::ento::CheckerFn< RET(Ps...)>::Checker
CheckerBase * Checker
Definition: CheckerManager.h:67
clang
Definition: CalledOnceCheck.h:17
clang::ento::CheckerManager::CheckerManager
CheckerManager(ASTContext &Context, AnalyzerOptions &AOptions, const Preprocessor &PP)
Constructs a CheckerManager that ignores all non TblGen-generated checkers.
Definition: CheckerManager.h:150
clang::ento::CheckerManager::_registerForBeginFunction
void _registerForBeginFunction(CheckBeginFunctionFunc checkfn)
Definition: CheckerManager.cpp:852
clang::Stmt
Stmt - This represents one statement.
Definition: Stmt.h:70
clang::ento::CheckerManager::CheckerManager
CheckerManager(ASTContext &Context, AnalyzerOptions &AOptions, const Preprocessor &PP, ArrayRef< std::string > plugins, ArrayRef< std::function< void(CheckerRegistry &)>> checkerRegistrationFns)
Definition: CreateCheckerManager.cpp:20
clang::ento::CallEvent
Represents an abstract call to a function or method along a particular path.
Definition: CallEvent.h:148
clang::ento::CheckerManager::runCheckersForEvalAssume
ProgramStateRef runCheckersForEvalAssume(ProgramStateRef state, SVal Cond, bool Assumption)
Run checkers for handling assumptions on symbolic values.
Definition: CheckerManager.cpp:639
clang::ento::CheckerManager::CheckDeclFunc
CheckerFn< void(const Decl *, AnalysisManager &, BugReporter &)> CheckDeclFunc
Definition: CheckerManager.h:471
clang::ento::PSK_EscapeOnBind
@ PSK_EscapeOnBind
A pointer escapes due to binding its value to a location that the analyzer cannot track.
Definition: CheckerManager.h:81
clang::ento::CheckerManager::_registerDispatcherForEvent
void _registerDispatcherForEvent()
Definition: CheckerManager.h:600
clang::ento::PointerEscapeKind
PointerEscapeKind
Describes the different reasons a pointer escapes during analysis.
Definition: CheckerManager.h:78
clang::ento::ObjCMessageVisitKind::MessageNil
@ MessageNil
clang::ento::NodeBuilderContext
Definition: CoreEngine.h:212
clang::ento::CheckerManager::_registerForPostCall
void _registerForPostCall(CheckCallFunc checkfn)
Definition: CheckerManager.cpp:836
clang::ento::CheckerContext
Definition: CheckerContext.h:23
clang::BlockEdge
Definition: ProgramPoint.h:502
clang::ento::Checker
Definition: Checker.h:517
clang::ento::SVal
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
Definition: SVals.h:73
clang::ento::CheckerManager::finishedCheckerRegistration
void finishedCheckerRegistration()
Definition: CheckerManager.cpp:53
clang::ento::CheckerFn< RET(Ps...)>::CheckerFn
CheckerFn(CheckerBase *checker, Func fn)
Definition: CheckerManager.h:69
clang::ento::RegionAndSymbolInvalidationTraits
Information about invalidation for a particular region/symbol.
Definition: MemRegion.h:1570
clang::Preprocessor
Engages in a tight little dance with the lexer to efficiently preprocess tokens.
Definition: Preprocessor.h:129
clang::ento::CheckerManager::runCheckersOnEndOfTranslationUnit
void runCheckersOnEndOfTranslationUnit(const TranslationUnitDecl *TU, AnalysisManager &mgr, BugReporter &BR)
Run checkers for the entire Translation Unit.
Definition: CheckerManager.cpp:714
clang::ento::CheckerManager::runCheckersForPointerEscape
ProgramStateRef runCheckersForPointerEscape(ProgramStateRef State, const InvalidatedSymbols &Escaped, const CallEvent *Call, PointerEscapeKind Kind, RegionAndSymbolInvalidationTraits *ITraits)
Run checkers when pointers escape.
Definition: CheckerManager.cpp:618
clang::ento::CheckerManager::runCheckersForPreStmt
void runCheckersForPreStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng)
Run checkers for pre-visiting Stmts.
Definition: CheckerManager.h:248
clang::ento::CheckerManager::_registerListenerForEvent
void _registerListenerForEvent(CheckEventFunc checkfn)
Definition: CheckerManager.h:594
clang::transformer::name
RangeSelector name(std::string ID)
Given a node with a "name", (like NamedDecl, DeclRefExpr, CxxCtorInitializer, and TypeLoc) selects th...
Definition: RangeSelector.cpp:200
clang::ento::CheckerManager::_registerForLiveSymbols
void _registerForLiveSymbols(CheckLiveSymbolsFunc checkfn)
Definition: CheckerManager.cpp:869
clang::ento::ExplodedNodeSet
Definition: ExplodedGraph.h:461
clang::ento::CheckerManager::~CheckerManager
~CheckerManager()
Definition: CreateCheckerManager.cpp:44
clang::ProgramPoint
Definition: ProgramPoint.h:58
clang::ento::CheckerManager::HandlesDeclFunc
bool(*)(const Decl *D) HandlesDeclFunc
Definition: CheckerManager.h:473
clang::ento::CheckerManager::_registerForEndAnalysis
void _registerForEndAnalysis(CheckEndAnalysisFunc checkfn)
Definition: CheckerManager.cpp:848
llvm::IntrusiveRefCntPtr
Definition: LLVM.h:47
clang::ento::CheckerManager::runCheckersForBind
void runCheckersForBind(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, SVal location, SVal val, const Stmt *S, ExprEngine &Eng, const ProgramPoint &PP)
Run checkers for binding of a value to a location.
Definition: CheckerManager.cpp:393
clang::ReturnStmt
ReturnStmt - This represents a return, optionally of an expression: return; return 4;.
Definition: Stmt.h:2792
clang::ento::CheckerRegistry
Manages a set of available checkers for running a static analysis.
Definition: CheckerRegistry.h:89
clang::ento::CheckerManager::_registerForDecl
void _registerForDecl(CheckDeclFunc checkfn, HandlesDeclFunc isForDeclFn)
Definition: CheckerManager.cpp:795
clang::ento::CheckerManager::_registerForPreObjCMessage
void _registerForPreObjCMessage(CheckObjCMessageFunc checkfn)
Definition: CheckerManager.cpp:821
clang::ento::CheckerFn
Definition: CheckerManager.h:58