clang::ento::bugreporter Namespace Reference

Classes
class	ExpressionHandler
	Handles expressions during the tracking. More...
class	StoreHandler
	Handles stores during the tracking. More...
struct	StoreInfo
	Describes an event when the value got stored into a memory region. More...
class	Tracker
	A generalized component for tracking expressions, values, and stores. More...
class	TrackingBugReporterVisitor
	Visitor that tracks expressions and values. More...
struct	TrackingOptions
	Defines a set of options altering tracking behavior. More...

Typedefs
using	TrackerRef = llvm::IntrusiveRefCntPtr< Tracker >

Enumerations
enum class	TrackingKind { Thorough , Condition }
	Specifies the type of tracking for an expression. More...

Functions
bool	trackExpressionValue (const ExplodedNode *N, const Expr *E, PathSensitiveBugReport &R, TrackingOptions Opts={})
	Attempts to add visitors to track expression value back to its point of origin.
void	trackStoredValue (SVal V, const MemRegion *R, PathSensitiveBugReport &Report, TrackingOptions Opts={}, const StackFrameContext *Origin=nullptr)
	Track how the value got stored into the given region and where it came from.
const Expr *	getDerefExpr (const Stmt *S)
	Given that expression S represents a pointer that would be dereferenced, try to find a sub-expression from which the pointer came from.

Typedef Documentation

TrackerRef

using clang::ento::bugreporter::TrackerRef = typedef llvm::IntrusiveRefCntPtr<Tracker>

Definition at line 163 of file BugReporterVisitors.h.

Enumeration Type Documentation

TrackingKind

enum class clang::ento::bugreporter::TrackingKind

strong

Specifies the type of tracking for an expression.

Enumerator
Thorough	Default tracking kind – specifies that as much information should be gathered about the tracked expression value as possible.
Condition	Specifies that a more moderate tracking should be used for the expression value. This will essentially make sure that functions relevant to it aren't pruned, but otherwise relies on the user reading the code or following the arrows.

Definition at line 102 of file BugReporterVisitors.h.

Function Documentation

getDerefExpr()

const Expr * clang::ento::bugreporter::getDerefExpr

(

const Stmt *

S

)

Given that expression S represents a pointer that would be dereferenced, try to find a sub-expression from which the pointer came from.

This is used for tracking down origins of a null or undefined value: "this is null because that is null because that is null" etc. We wipe away field and element offsets because they merely add offsets. We also wipe away all casts except lvalue-to-rvalue casts, because the latter represent an actual pointer dereference; however, we remove the final lvalue-to-rvalue cast before returning from this function because it demonstrates more clearly from where the pointer rvalue was loaded. Examples: x->y.z ==> x (lvalue) foo()->y.z ==> foo() (rvalue)

Definition at line 101 of file BugReporterVisitors.cpp.

References E, and peelOffPointerArithmetic().

Referenced by peelOffOuterExpr().

trackExpressionValue()

bool clang::ento::bugreporter::trackExpressionValue	(	const ExplodedNode *	N,
		const Expr *	E,
		PathSensitiveBugReport &	R,
		TrackingOptions	Opts = {}
	)

Attempts to add visitors to track expression value back to its point of origin.

Parameters

N	A node "downstream" from the evaluation of the statement.
E	The expression value which we are tracking
R	The bug report to which visitors should be attached.
Opts	Tracking options specifying how we are tracking the value.

Returns

Whether or not the function was able to add visitors for this statement. Note that returning true does not actually imply that any visitors were added.

Definition at line 2600 of file BugReporterVisitors.cpp.

References clang::ento::bugreporter::Tracker::create(), E, and clang::sema::Report.

Referenced by emitBug(), and clang::ento::NilReceiverBRVisitor::VisitNode().

trackStoredValue()

void clang::ento::bugreporter::trackStoredValue	(	SVal	V,
		const MemRegion *	R,
		PathSensitiveBugReport &	Report,
		TrackingOptions	Opts = {},
		const StackFrameContext *	Origin = nullptr
	)

Track how the value got stored into the given region and where it came from.

Parameters

V	We're searching for the store where R received this value. It may be either defined or undefined, but should not be unknown.
R	The region we're tracking.
Opts	Tracking options specifying how we want to track the value.
Origin	Only adds notes when the last store happened in a different stackframe to this one. Disregarded if the tracking kind is thorough. This is useful, because for non-tracked regions, notes about changes to its value in a nested stackframe could be pruned, and this visitor can prevent that without polluting the bugpath too much.

Definition at line 2610 of file BugReporterVisitors.cpp.

References clang::ento::bugreporter::Tracker::create(), clang::sema::Report, and V.