1 //== CheckerContext.h - Context info for path-sensitive checkers--*- C++ -*--=//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // This file defines CheckerContext that provides contextual info for
11 // path-sensitive checkers.
13 //===----------------------------------------------------------------------===//
15 #ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CHECKERCONTEXT_H
16 #define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CHECKERCONTEXT_H
18 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
19 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
24 /// Declares an immutable map of type \p NameTy, suitable for placement into
25 /// the ProgramState. This is implementing using llvm::ImmutableMap.
28 /// State = State->set<Name>(K, V);
29 /// const Value *V = State->get<Name>(K); // Returns NULL if not in the map.
30 /// State = State->remove<Name>(K);
31 /// NameTy Map = State->get<Name>();
34 /// The macro should not be used inside namespaces, or for traits that must
35 /// be accessible from more than one translation unit.
36 #define REGISTER_MAP_WITH_PROGRAMSTATE(Name, Key, Value) \
37 REGISTER_TRAIT_WITH_PROGRAMSTATE(Name, \
38 CLANG_ENTO_PROGRAMSTATE_MAP(Key, Value))
40 /// Declares an immutable set of type \p NameTy, suitable for placement into
41 /// the ProgramState. This is implementing using llvm::ImmutableSet.
44 /// State = State->add<Name>(E);
45 /// State = State->remove<Name>(E);
46 /// bool Present = State->contains<Name>(E);
47 /// NameTy Set = State->get<Name>();
50 /// The macro should not be used inside namespaces, or for traits that must
51 /// be accessible from more than one translation unit.
52 #define REGISTER_SET_WITH_PROGRAMSTATE(Name, Elem) \
53 REGISTER_TRAIT_WITH_PROGRAMSTATE(Name, llvm::ImmutableSet<Elem>)
55 /// Declares an immutable list of type \p NameTy, suitable for placement into
56 /// the ProgramState. This is implementing using llvm::ImmutableList.
59 /// State = State->add<Name>(E); // Adds to the /end/ of the list.
60 /// bool Present = State->contains<Name>(E);
61 /// NameTy List = State->get<Name>();
64 /// The macro should not be used inside namespaces, or for traits that must
65 /// be accessible from more than one translation unit.
66 #define REGISTER_LIST_WITH_PROGRAMSTATE(Name, Elem) \
67 REGISTER_TRAIT_WITH_PROGRAMSTATE(Name, llvm::ImmutableList<Elem>)
70 class CheckerContext {
72 /// The current exploded(symbolic execution) graph node.
74 /// The flag is true if the (state of the execution) has been modified
75 /// by the checker using this context. For example, a new transition has been
76 /// added or a bug report issued.
78 /// The tagged location, which is used to generate all new nodes.
79 const ProgramPoint Location;
83 /// If we are post visiting a call, this flag will be set if the
84 /// call was inlined. In all other cases it will be false.
85 const bool wasInlined;
87 CheckerContext(NodeBuilder &builder,
90 const ProgramPoint &loc,
91 bool wasInlined = false)
97 wasInlined(wasInlined) {
98 assert(Pred->getState() &&
99 "We should not call the checkers on an empty state.");
102 AnalysisManager &getAnalysisManager() {
103 return Eng.getAnalysisManager();
106 ConstraintManager &getConstraintManager() {
107 return Eng.getConstraintManager();
110 StoreManager &getStoreManager() {
111 return Eng.getStoreManager();
114 /// Returns the previous node in the exploded graph, which includes
115 /// the state of the program before the checker ran. Note, checkers should
116 /// not retain the node in their state since the nodes might get invalidated.
117 ExplodedNode *getPredecessor() { return Pred; }
118 const ProgramStateRef &getState() const { return Pred->getState(); }
120 /// Check if the checker changed the state of the execution; ex: added
121 /// a new transition or a bug report.
122 bool isDifferent() { return Changed; }
124 /// Returns the number of times the current block has been visited
125 /// along the analyzed path.
126 unsigned blockCount() const {
127 return NB.getContext().blockCount();
130 ASTContext &getASTContext() {
131 return Eng.getContext();
134 const LangOptions &getLangOpts() const {
135 return Eng.getContext().getLangOpts();
138 const LocationContext *getLocationContext() const {
139 return Pred->getLocationContext();
142 const StackFrameContext *getStackFrame() const {
143 return Pred->getStackFrame();
146 /// Return true if the current LocationContext has no caller context.
147 bool inTopFrame() const { return getLocationContext()->inTopFrame(); }
149 BugReporter &getBugReporter() {
150 return Eng.getBugReporter();
153 SourceManager &getSourceManager() {
154 return getBugReporter().getSourceManager();
157 SValBuilder &getSValBuilder() {
158 return Eng.getSValBuilder();
161 SymbolManager &getSymbolManager() {
162 return getSValBuilder().getSymbolManager();
165 bool isObjCGCEnabled() const {
166 return Eng.isObjCGCEnabled();
169 ProgramStateManager &getStateManager() {
170 return Eng.getStateManager();
173 AnalysisDeclContext *getCurrentAnalysisDeclContext() const {
174 return Pred->getLocationContext()->getAnalysisDeclContext();
178 unsigned getBlockID() const {
179 return NB.getContext().getBlock()->getBlockID();
182 /// If the given node corresponds to a PostStore program point,
183 /// retrieve the location region as it was uttered in the code.
185 /// This utility can be useful for generating extensive diagnostics, for
186 /// example, for finding variables that the given symbol was assigned to.
187 static const MemRegion *getLocationRegionIfPostStore(const ExplodedNode *N) {
188 ProgramPoint L = N->getLocation();
189 if (Optional<PostStore> PSL = L.getAs<PostStore>())
190 return reinterpret_cast<const MemRegion*>(PSL->getLocationValue());
194 /// Get the value of arbitrary expressions at this point in the path.
195 SVal getSVal(const Stmt *S) const {
196 return Pred->getSVal(S);
199 /// Returns true if the value of \p E is greater than or equal to \p
200 /// Val under unsigned comparison
201 bool isGreaterOrEqual(const Expr *E, unsigned long long Val);
203 /// Returns true if the value of \p E is negative.
204 bool isNegative(const Expr *E);
206 /// Generates a new transition in the program state graph
207 /// (ExplodedGraph). Uses the default CheckerContext predecessor node.
209 /// @param State The state of the generated node. If not specified, the state
210 /// will not be changed, but the new node will have the checker's tag.
211 /// @param Tag The tag is used to uniquely identify the creation site. If no
212 /// tag is specified, a default tag, unique to the given checker,
213 /// will be used. Tags are used to prevent states generated at
214 /// different sites from caching out.
215 ExplodedNode *addTransition(ProgramStateRef State = nullptr,
216 const ProgramPointTag *Tag = nullptr) {
217 return addTransitionImpl(State ? State : getState(), false, nullptr, Tag);
220 /// Generates a new transition with the given predecessor.
221 /// Allows checkers to generate a chain of nodes.
223 /// @param State The state of the generated node.
224 /// @param Pred The transition will be generated from the specified Pred node
225 /// to the newly generated node.
226 /// @param Tag The tag to uniquely identify the creation site.
227 ExplodedNode *addTransition(ProgramStateRef State,
229 const ProgramPointTag *Tag = nullptr) {
230 return addTransitionImpl(State, false, Pred, Tag);
233 /// Generate a sink node. Generating a sink stops exploration of the
234 /// given path. To create a sink node for the purpose of reporting an error,
235 /// checkers should use generateErrorNode() instead.
236 ExplodedNode *generateSink(ProgramStateRef State, ExplodedNode *Pred,
237 const ProgramPointTag *Tag = nullptr) {
238 return addTransitionImpl(State ? State : getState(), true, Pred, Tag);
241 /// Generate a transition to a node that will be used to report
242 /// an error. This node will be a sink. That is, it will stop exploration of
245 /// @param State The state of the generated node.
246 /// @param Tag The tag to uniquely identify the creation site. If null,
247 /// the default tag for the checker will be used.
248 ExplodedNode *generateErrorNode(ProgramStateRef State = nullptr,
249 const ProgramPointTag *Tag = nullptr) {
250 return generateSink(State, Pred,
251 (Tag ? Tag : Location.getTag()));
254 /// Generate a transition to a node that will be used to report
255 /// an error. This node will not be a sink. That is, exploration will
256 /// continue along this path.
258 /// @param State The state of the generated node.
259 /// @param Tag The tag to uniquely identify the creation site. If null,
260 /// the default tag for the checker will be used.
262 generateNonFatalErrorNode(ProgramStateRef State = nullptr,
263 const ProgramPointTag *Tag = nullptr) {
264 return addTransition(State, (Tag ? Tag : Location.getTag()));
267 /// Emit the diagnostics report.
268 void emitReport(std::unique_ptr<BugReport> R) {
270 Eng.getBugReporter().emitReport(std::move(R));
273 /// Returns the word that should be used to refer to the declaration
275 StringRef getDeclDescription(const Decl *D);
277 /// Get the declaration of the called function (path-sensitive).
278 const FunctionDecl *getCalleeDecl(const CallExpr *CE) const;
280 /// Get the name of the called function (path-sensitive).
281 StringRef getCalleeName(const FunctionDecl *FunDecl) const;
283 /// Get the identifier of the called function (path-sensitive).
284 const IdentifierInfo *getCalleeIdentifier(const CallExpr *CE) const {
285 const FunctionDecl *FunDecl = getCalleeDecl(CE);
287 return FunDecl->getIdentifier();
292 /// Get the name of the called function (path-sensitive).
293 StringRef getCalleeName(const CallExpr *CE) const {
294 const FunctionDecl *FunDecl = getCalleeDecl(CE);
295 return getCalleeName(FunDecl);
298 /// Returns true if the callee is an externally-visible function in the
299 /// top-level namespace, such as \c malloc.
301 /// If a name is provided, the function must additionally match the given
304 /// Note that this deliberately excludes C++ library functions in the \c std
305 /// namespace, but will include C library functions accessed through the
306 /// \c std namespace. This also does not check if the function is declared
307 /// as 'extern "C"', or if it uses C++ name mangling.
308 static bool isCLibraryFunction(const FunctionDecl *FD,
309 StringRef Name = StringRef());
311 /// Depending on wither the location corresponds to a macro, return
312 /// either the macro name or the token spelling.
314 /// This could be useful when checkers' logic depends on whether a function
315 /// is called with a given macro argument. For example:
316 /// s = socket(AF_INET,..)
317 /// If AF_INET is a macro, the result should be treated as a source of taint.
319 /// \sa clang::Lexer::getSpelling(), clang::Lexer::getImmediateMacroName().
320 StringRef getMacroNameOrSpelling(SourceLocation &Loc);
323 ExplodedNode *addTransitionImpl(ProgramStateRef State,
325 ExplodedNode *P = nullptr,
326 const ProgramPointTag *Tag = nullptr) {
327 // The analyzer may stop exploring if it sees a state it has previously
328 // visited ("cache out"). The early return here is a defensive check to
329 // prevent accidental caching out by checker API clients. Unless there is a
330 // tag or the client checker has requested that the generated node be
331 // marked as a sink, we assume that a client requesting a transition to a
332 // state that is the same as the predecessor state has made a mistake. We
333 // return the predecessor rather than cache out.
335 // TODO: We could potentially change the return to an assertion to alert
336 // clients to their mistake, but several checkers (including
337 // DereferenceChecker, CallAndMessageChecker, and DynamicTypePropagation)
338 // rely upon the defensive behavior and would need to be updated.
339 if (!State || (State == Pred->getState() && !Tag && !MarkAsSink))
343 const ProgramPoint &LocalLoc = (Tag ? Location.withTag(Tag) : Location);
349 node = NB.generateSink(LocalLoc, State, P);
351 node = NB.generateNode(LocalLoc, State, P);
356 } // end GR namespace
358 } // end clang namespace