clang 19.0.0git
Classes | Typedefs | Enumerations | Functions
clang::ento::bugreporter Namespace Reference

Classes

class  ExpressionHandler
 Handles expressions during the tracking. More...
 
class  StoreHandler
 Handles stores during the tracking. More...
 
struct  StoreInfo
 Describes an event when the value got stored into a memory region. More...
 
class  Tracker
 A generalized component for tracking expressions, values, and stores. More...
 
class  TrackingBugReporterVisitor
 Visitor that tracks expressions and values. More...
 
struct  TrackingOptions
 Defines a set of options altering tracking behavior. More...
 

Typedefs

using TrackerRef = llvm::IntrusiveRefCntPtr< Tracker >
 

Enumerations

enum class  TrackingKind { Thorough , Condition }
 Specifies the type of tracking for an expression. More...
 

Functions

bool trackExpressionValue (const ExplodedNode *N, const Expr *E, PathSensitiveBugReport &R, TrackingOptions Opts={})
 Attempts to add visitors to track expression value back to its point of origin.
 
void trackStoredValue (KnownSVal V, const MemRegion *R, PathSensitiveBugReport &Report, TrackingOptions Opts={}, const StackFrameContext *Origin=nullptr)
 Track how the value got stored into the given region and where it came from.
 
const ExprgetDerefExpr (const Stmt *S)
 Given that expression S represents a pointer that would be dereferenced, try to find a sub-expression from which the pointer came from.
 

Typedef Documentation

◆ TrackerRef

Definition at line 163 of file BugReporterVisitors.h.

Enumeration Type Documentation

◆ TrackingKind

Specifies the type of tracking for an expression.

Enumerator
Thorough 

Default tracking kind – specifies that as much information should be gathered about the tracked expression value as possible.

Condition 

Specifies that a more moderate tracking should be used for the expression value.

This will essentially make sure that functions relevant to it aren't pruned, but otherwise relies on the user reading the code or following the arrows.

Definition at line 102 of file BugReporterVisitors.h.

Function Documentation

◆ getDerefExpr()

const Expr * clang::ento::bugreporter::getDerefExpr ( const Stmt S)

Given that expression S represents a pointer that would be dereferenced, try to find a sub-expression from which the pointer came from.

This is used for tracking down origins of a null or undefined value: "this is null because that is null because that is null" etc. We wipe away field and element offsets because they merely add offsets. We also wipe away all casts except lvalue-to-rvalue casts, because the latter represent an actual pointer dereference; however, we remove the final lvalue-to-rvalue cast before returning from this function because it demonstrates more clearly from where the pointer rvalue was loaded. Examples: x->y.z ==> x (lvalue) foo()->y.z ==> foo() (rvalue)

Definition at line 100 of file BugReporterVisitors.cpp.

References peelOffPointerArithmetic().

Referenced by peelOffOuterExpr().

◆ trackExpressionValue()

bool clang::ento::bugreporter::trackExpressionValue ( const ExplodedNode N,
const Expr E,
PathSensitiveBugReport R,
TrackingOptions  Opts = {} 
)

Attempts to add visitors to track expression value back to its point of origin.

Parameters
NA node "downstream" from the evaluation of the statement.
EThe expression value which we are tracking
RThe bug report to which visitors should be attached.
OptsTracking options specifying how we are tracking the value.
Returns
Whether or not the function was able to add visitors for this statement. Note that returning true does not actually imply that any visitors were added.

Definition at line 2685 of file BugReporterVisitors.cpp.

References clang::ento::bugreporter::Tracker::create().

Referenced by emitBug(), and clang::ento::NilReceiverBRVisitor::VisitNode().

◆ trackStoredValue()

void clang::ento::bugreporter::trackStoredValue ( KnownSVal  V,
const MemRegion R,
PathSensitiveBugReport Report,
TrackingOptions  Opts = {},
const StackFrameContext Origin = nullptr 
)

Track how the value got stored into the given region and where it came from.

Parameters
VWe're searching for the store where R received this value.
RThe region we're tracking.
OptsTracking options specifying how we want to track the value.
OriginOnly adds notes when the last store happened in a different stackframe to this one. Disregarded if the tracking kind is thorough. This is useful, because for non-tracked regions, notes about changes to its value in a nested stackframe could be pruned, and this visitor can prevent that without polluting the bugpath too much.

Definition at line 2695 of file BugReporterVisitors.cpp.

References clang::ento::bugreporter::Tracker::create(), and V.