BugReporterVisitors.h Source File (original) (raw)

14#ifndef LLVM_CLANG_STATICANALYZER_CORE_BUGREPORTER_BUGREPORTERVISITORS_H

15#define LLVM_CLANG_STATICANALYZER_CORE_BUGREPORTER_BUGREPORTERVISITORS_H

21#include "llvm/ADT/FoldingSet.h"

22#include "llvm/ADT/IntrusiveRefCntPtr.h"

23#include "llvm/ADT/STLExtras.h"

24#include "llvm/ADT/SmallPtrSet.h"

25#include "llvm/ADT/StringRef.h"

26#include

27#include

28#include

29#include

39namespace ento {

50public:

91 virtual void Profile(llvm::FoldingSetNodeID &ID) const = 0;

97};

100

101

103

104

106

107

108

109

111};

112

113

121

122

123

124

125

126

129

130

132

133

134

136

137

139

140

141

142

144 };

145

146

148

150

151

153

155

156

157

158

160};

161

164

167

168

169

170

171

172

174private:

175 using ExpressionHandlerPtr = std::unique_ptr;

176 using StoreHandlerPtr = std::unique_ptr;

177

179 std::list ExpressionHandlers;

180 std::list StoreHandlers;

181

182protected:

183

185

186public:

188

190 return new Tracker(Report);

191 }

192

194

195

196

198

200

201

203

204

212 };

213

214

215

216

217

218

221

222

223

224

225

226

227

228

229

230

231

232

233

234

237

238

239

240

241

242

243

245 TrackingOptions Opts);

246

247

248

249

250

252 ExpressionHandlers.push_front(std::move(SH));

253 }

254

255

256

257

258

260 ExpressionHandlers.push_back(std::move(SH));

261 }

262

263

264

265

266

268 StoreHandlers.push_front(std::move(SH));

269 }

270

271

272

273

274

276 StoreHandlers.push_back(std::move(SH));

277 }

278

279

280

281

282 template <class HandlerType, class... Args>

285 *this, std::forward(ConstructorArgs)...));

286 }

287

288

289

290

291 template <class HandlerType, class... Args>

294 *this, std::forward(ConstructorArgs)...));

295 }

296};

297

298

300private:

302

303public:

306

307

308

309

310

311

312

316

317

319};

320

321

323private:

325

326public:

329

330

331

332

333

334

335

336

339

341

342protected:

344 StringRef NodeText);

345};

346

347

349private:

351

352public:

354 : ParentTracker(ParentTracker) {}

355

357};

358

359

360

361

362

363

364

365

366

367

368

369

372

373

374

375

376

377

378

379

380

381

382

383

384

385

386

388 PathSensitiveBugReport &Report, TrackingOptions Opts = {},

389 const StackFrameContext *Origin = nullptr);

390

392

393}

394

398 const bool Assumption;

399 bool IsSatisfied = false;

400

401

402

403 bool IsTrackingTurnedOn = false;

404

405public:

407 StringRef Message)

408 : Message(Message), Constraint(constraint), Assumption(assumption) {}

409

410 void Profile(llvm::FoldingSetNodeID &ID) const override;

411

412

413

414 static const char *getTag();

415

419

420private:

421

422 bool isZeroCheck() const;

423

424

425 bool isUnderconstrained(const ExplodedNode *N) const;

426};

427

428

429

431public:

432 void Profile(llvm::FoldingSetNodeID &ID) const override {

433 static int x = 0;

434 ID.AddPointer(&x);

435 }

436

440

441

442

444};

445

446

448

449 constexpr static llvm::StringLiteral GenericTrueMessage =

450 "Assuming the condition is true";

451 constexpr static llvm::StringLiteral GenericFalseMessage =

452 "Assuming the condition is false";

453

454public:

455 void Profile(llvm::FoldingSetNodeID &ID) const override {

456 static int x = 0;

457 ID.AddPointer(&x);

458 }

459

460

461

462 static const char *getTag();

463

467

471

476

481

486 bool IsAssuming);

487

491 const ExplodedNode *N, bool TookTrue, bool IsAssuming);

492

497 bool IsAssuming);

498

503

504

505

506

507

508

509

510

511

512

513 bool printValue(const Expr *CondVarExpr, raw_ostream &Out,

514 const ExplodedNode *N, bool TookTrue, bool IsAssuming);

515

518 const ExplodedNode *N, std::optional &prunable,

519 bool IsSameFieldName);

520

522};

523

524

525

526

529public:

531 static int Tag = 0;

532 return static_cast<void *>(&Tag);

533 }

534

535 void Profile(llvm::FoldingSetNodeID &ID) const override {

536 ID.AddPointer(getTag());

537 }

538

541 return nullptr;

542 }

543

546};

547

548

549

550

551

552

554

556

557public:

559

560 void Profile(llvm::FoldingSetNodeID &ID) const override {

561 static int Tag = 0;

562 ID.AddPointer(&Tag);

563 ID.AddPointer(R);

564 }

565

569};

570

572

573

575

576

577 bool IsSatisfied = false;

578

579

580

581

582

583

584 bool IsTrackingTurnedOn = false;

585

586public:

588

589 void Profile(llvm::FoldingSetNodeID &ID) const override;

590

591

592

593 static const char *getTag();

594

598};

599

600

602public:

603 void Profile(llvm::FoldingSetNodeID &ID) const override;

604

608};

609

612

613

614

615

616

617

618

619

620

621

622

624private:

625

626

627

628

629

630

631

632

633

634

637

638

639

640

641 bool isModifiedInFrame(const ExplodedNode *CallExitBeginN);

642

644

645

646

647 void findModifyingFrames(const ExplodedNode *const CallExitBeginN);

648

649protected:

651

652

653

654

655

656

657

658

659

660

665

666

667

668

669

670

671

672

673

674

675

676

677

678

683

684

685

686

687

688

693

694

695

696

697

698

703

704

705

706

707

708

712

713public:

715

719};

720

721

722

723

724

726 const SubRegion *RegionOfInterest;

730

731

732

733

734 static const unsigned DEREFERENCE_LIMIT = 2;

735

737

738public:

743 MmrMgr(R->getMemRegionManager()),

744 SM(MmrMgr.getContext().getSourceManager()),

745 PP(MmrMgr.getContext().getPrintingPolicy()) {}

746

747 void Profile(llvm::FoldingSetNodeID &ID) const override {

748 static int Tag = 0;

749 ID.AddPointer(&Tag);

750 ID.AddPointer(RegionOfInterest);

751 }

752

753private:

754

755

756 bool wasModifiedBeforeCallExit(const ExplodedNode *CurrN,

757 const ExplodedNode *CallExitBeginN) override;

758

759

760

761

762

763

764

765 const std::optional

767 const MemRegion *R, const RegionVector &Vec = {},

768 int depth = 0);

769

770

771

773 const ObjCMethodCall &Call,

774 const ExplodedNode *N) final;

775

777 const CXXConstructorCall &Call,

778 const ExplodedNode *N) final;

779

781 maybeEmitNoteForParameters(PathSensitiveBugReport &R, const CallEvent &Call,

782 const ExplodedNode *N) final;

783

784

785

786

787

789 maybeEmitNote(PathSensitiveBugReport &R, const CallEvent &Call,

790 const ExplodedNode *N, const RegionVector &FieldChain,

791 const MemRegion *MatchedRegion, StringRef FirstElement,

792 bool FirstIsReferenceType, unsigned IndirectionLevel);

793

794 bool prettyPrintRegionName(const RegionVector &FieldChain,

795 const MemRegion *MatchedRegion,

796 StringRef FirstElement, bool FirstIsReferenceType,

797 unsigned IndirectionLevel,

798 llvm::raw_svector_ostream &os);

799

800 StringRef prettyPrintFirstElement(StringRef FirstElement,

801 bool MoreItemsExpected,

802 int IndirectionLevel,

803 llvm::raw_svector_ostream &os);

804};

805

806}

807}

808

809#endif

Forward-declares and imports various common LLVM datatypes that clang wants to use unqualified.

A builtin binary operation expression such as "x + y" or "x <= y".

Represents a single basic block in a source-level CFG.

A reference to a declared variable, function, enum, etc.

This represents one expression.

MemberExpr - [C99 6.5.2.3] Structure and Union Members.

Represents a struct/union/class.

This class handles loading and caching of source files into memory.

It represents a stack frame of the call stack (based on CallEvent).

Stmt - This represents one statement.

virtual void Profile(llvm::FoldingSetNodeID &ID) const =0

BugReporterVisitor(BugReporterVisitor &&)

Definition BugReporterVisitors.h:53

virtual PathDiagnosticPieceRef VisitNode(const ExplodedNode *Succ, BugReporterContext &BRC, PathSensitiveBugReport &BR)=0

Return a diagnostic piece which should be associated with the given node.

BugReporterVisitor & operator=(BugReporterVisitor &&)=delete

BugReporterVisitor(const BugReporterVisitor &)=default

BugReporterVisitor()=default

static PathDiagnosticPieceRef getDefaultEndPath(const BugReporterContext &BRC, const ExplodedNode *N, const PathSensitiveBugReport &BR)

Generates the default final diagnostic piece.

virtual ~BugReporterVisitor()

virtual PathDiagnosticPieceRef getEndPath(BugReporterContext &BRC, const ExplodedNode *N, PathSensitiveBugReport &BR)

Provide custom definition for the final diagnostic piece on the path - the piece, which is displayed ...

BugReporterVisitor & operator=(const BugReporterVisitor &)=delete

virtual void finalizeVisitor(BugReporterContext &BRC, const ExplodedNode *EndPathNode, PathSensitiveBugReport &BR)

Last function called on the visitor, no further calls to VisitNode would follow.

Represents a call to a C++ constructor.

Represents an abstract call to a function or method along a particular path.

Visitor that tries to report interesting diagnostics from conditions.

Definition BugReporterVisitors.h:447

PathDiagnosticPieceRef VisitTerminator(const Stmt *Term, const ExplodedNode *N, const CFGBlock *SrcBlk, const CFGBlock *DstBlk, PathSensitiveBugReport &R, BugReporterContext &BRC)

bool printValue(const Expr *CondVarExpr, raw_ostream &Out, const ExplodedNode *N, bool TookTrue, bool IsAssuming)

Tries to print the value of the given expression.

PathDiagnosticPieceRef VisitNode(const ExplodedNode *N, BugReporterContext &BRC, PathSensitiveBugReport &BR) override

Return a diagnostic piece which should be associated with the given node.

bool patternMatch(const Expr *Ex, const Expr *ParentEx, raw_ostream &Out, BugReporterContext &BRC, PathSensitiveBugReport &R, const ExplodedNode *N, std::optional< bool > &prunable, bool IsSameFieldName)

static bool isPieceMessageGeneric(const PathDiagnosticPiece *Piece)

PathDiagnosticPieceRef VisitConditionVariable(StringRef LhsString, const Expr *CondVarExpr, BugReporterContext &BRC, PathSensitiveBugReport &R, const ExplodedNode *N, bool TookTrue)

PathDiagnosticPieceRef VisitTrueTest(const Expr *Cond, BugReporterContext &BRC, PathSensitiveBugReport &R, const ExplodedNode *N, bool TookTrue)

static const char * getTag()

Return the tag associated with this visitor.

PathDiagnosticPieceRef VisitNodeImpl(const ExplodedNode *N, BugReporterContext &BRC, PathSensitiveBugReport &BR)

void Profile(llvm::FoldingSetNodeID &ID) const override

Definition BugReporterVisitors.h:455

Suppress reports that might lead to known false positives.

Definition BugReporterVisitors.h:528

void finalizeVisitor(BugReporterContext &BRC, const ExplodedNode *N, PathSensitiveBugReport &BR) override

Last function called on the visitor, no further calls to VisitNode would follow.

static void * getTag()

Definition BugReporterVisitors.h:530

void Profile(llvm::FoldingSetNodeID &ID) const override

Definition BugReporterVisitors.h:535

PathDiagnosticPieceRef VisitNode(const ExplodedNode *, BugReporterContext &, PathSensitiveBugReport &) override

Return a diagnostic piece which should be associated with the given node.

Definition BugReporterVisitors.h:539

MemRegion - The root abstract class for all memory regions.

Prints path notes when a message is sent to a nil receiver.

Definition BugReporterVisitors.h:430

PathDiagnosticPieceRef VisitNode(const ExplodedNode *N, BugReporterContext &BRC, PathSensitiveBugReport &BR) override

Return a diagnostic piece which should be associated with the given node.

void Profile(llvm::FoldingSetNodeID &ID) const override

Definition BugReporterVisitors.h:432

static const Expr * getNilReceiver(const Stmt *S, const ExplodedNode *N)

If the statement is a message send expression with nil receiver, returns the receiver expression.

virtual bool wasModifiedBeforeCallExit(const ExplodedNode *CurrN, const ExplodedNode *CallExitBeginN)

Definition BugReporterVisitors.h:661

virtual PathDiagnosticPieceRef maybeEmitNoteForObjCSelf(PathSensitiveBugReport &R, const ObjCMethodCall &Call, const ExplodedNode *N)=0

Consume the information on the non-modifying stack frame in order to either emit a note or not.

virtual PathDiagnosticPieceRef maybeEmitNoteForCXXThis(PathSensitiveBugReport &R, const CXXConstructorCall &Call, const ExplodedNode *N)=0

Consume the information on the non-modifying stack frame in order to either emit a note or not.

bugreporter::TrackingKind TKind

Definition BugReporterVisitors.h:650

NoStateChangeFuncVisitor(bugreporter::TrackingKind TKind)

Definition BugReporterVisitors.h:714

virtual bool wasModifiedInFunction(const ExplodedNode *CallEnterN, const ExplodedNode *CallExitEndN)

Definition BugReporterVisitors.h:679

PathDiagnosticPieceRef VisitNode(const ExplodedNode *N, BugReporterContext &BR, PathSensitiveBugReport &R) final

Return a diagnostic piece which should be associated with the given node.

virtual PathDiagnosticPieceRef maybeEmitNoteForParameters(PathSensitiveBugReport &R, const CallEvent &Call, const ExplodedNode *N)=0

Consume the information on the non-modifying stack frame in order to either emit a note or not.

void Profile(llvm::FoldingSetNodeID &ID) const override

Definition BugReporterVisitors.h:747

NoStoreFuncVisitor(const SubRegion *R, bugreporter::TrackingKind TKind=bugreporter::TrackingKind::Thorough)

Definition BugReporterVisitors.h:739

Represents any expression that calls an Objective-C method.

SVal - This represents a symbolic expression, which can be either an L-value or an R-value.

SubRegion - A region that subsets another larger region.

PathDiagnosticPieceRef VisitNode(const ExplodedNode *Succ, BugReporterContext &BRC, PathSensitiveBugReport &BR) override

Return a diagnostic piece which should be associated with the given node.

SuppressInlineDefensiveChecksVisitor(DefinedSVal Val, const ExplodedNode *N)

static const char * getTag()

Return the tag associated with this visitor.

void Profile(llvm::FoldingSetNodeID &ID) const override

The visitor detects NoteTags and displays the event notes they contain.

Definition BugReporterVisitors.h:601

void Profile(llvm::FoldingSetNodeID &ID) const override

PathDiagnosticPieceRef VisitNode(const ExplodedNode *N, BugReporterContext &BRC, PathSensitiveBugReport &R) override

Return a diagnostic piece which should be associated with the given node.

void Profile(llvm::FoldingSetNodeID &ID) const override

static const char * getTag()

Return the tag associated with this visitor.

TrackConstraintBRVisitor(DefinedSVal constraint, bool assumption, StringRef Message)

Definition BugReporterVisitors.h:406

PathDiagnosticPieceRef VisitNode(const ExplodedNode *N, BugReporterContext &BRC, PathSensitiveBugReport &BR) override

Return a diagnostic piece which should be associated with the given node.

PathDiagnosticPieceRef VisitNode(const ExplodedNode *N, BugReporterContext &BRC, PathSensitiveBugReport &BR) override

Return a diagnostic piece which should be associated with the given node.

void Profile(llvm::FoldingSetNodeID &ID) const override

Definition BugReporterVisitors.h:560

UndefOrNullArgVisitor(const MemRegion *InR)

Definition BugReporterVisitors.h:558

Handles expressions during the tracking.

Definition BugReporterVisitors.h:299

virtual Tracker::Result handle(const Expr *E, const ExplodedNode *Original, const ExplodedNode *ExprNode, TrackingOptions Opts)=0

Handle the given expression from the given node.

virtual ~ExpressionHandler()

Definition BugReporterVisitors.h:305

Tracker & getParentTracker()

\Return the tracker that initiated the process.

Definition BugReporterVisitors.h:318

ExpressionHandler(Tracker &ParentTracker)

Definition BugReporterVisitors.h:304

Handles stores during the tracking.

Definition BugReporterVisitors.h:322

virtual PathDiagnosticPieceRef handle(StoreInfo SI, BugReporterContext &BRC, TrackingOptions Opts)=0

Handle the given store and produce the node.

Tracker & getParentTracker()

Definition BugReporterVisitors.h:340

StoreHandler(Tracker &ParentTracker)

Definition BugReporterVisitors.h:327

PathDiagnosticPieceRef constructNote(StoreInfo SI, BugReporterContext &BRC, StringRef NodeText)

virtual ~StoreHandler()

Definition BugReporterVisitors.h:328

A generalized component for tracking expressions, values, and stores.

Definition BugReporterVisitors.h:173

void addLowPriorityHandler(ExpressionHandlerPtr SH)

Add custom expression handler with the lowest priority.

Definition BugReporterVisitors.h:259

static TrackerRef create(PathSensitiveBugReport &Report)

Definition BugReporterVisitors.h:189

PathSensitiveBugReport & getReport()

Definition BugReporterVisitors.h:193

void addHighPriorityHandler(Args &&... ConstructorArgs)

Add custom expression/store handler with the highest priority.

Definition BugReporterVisitors.h:283

virtual PathDiagnosticPieceRef handle(StoreInfo SI, BugReporterContext &BRC, TrackingOptions Opts)

Handle the store operation and produce the note.

void addHighPriorityHandler(StoreHandlerPtr SH)

Add custom store handler with the highest priority.

Definition BugReporterVisitors.h:267

void addHighPriorityHandler(ExpressionHandlerPtr SH)

Add custom expression handler with the highest priority.

Definition BugReporterVisitors.h:251

void addLowPriorityHandler(Args &&... ConstructorArgs)

Add custom expression/store handler with the lowest priority.

Definition BugReporterVisitors.h:292

void addLowPriorityHandler(StoreHandlerPtr SH)

Add custom store handler with the lowest priority.

Definition BugReporterVisitors.h:275

Tracker(PathSensitiveBugReport &Report)

virtual ~Tracker()=default

virtual Result track(const Expr *E, const ExplodedNode *N, TrackingOptions Opts={})

Track expression value back to its point of origin.

Tracker & getParentTracker()

Definition BugReporterVisitors.h:356

TrackingBugReporterVisitor(TrackerRef ParentTracker)

Definition BugReporterVisitors.h:353

llvm::IntrusiveRefCntPtr< Tracker > TrackerRef

Definition BugReporterVisitors.h:163

const Expr * getDerefExpr(const Stmt *S)

Given that expression S represents a pointer that would be dereferenced, try to find a sub-expression...

bool trackExpressionValue(const ExplodedNode *N, const Expr *E, PathSensitiveBugReport &R, TrackingOptions Opts={})

Attempts to add visitors to track expression value back to its point of origin.

void trackStoredValue(SVal V, const MemRegion *R, PathSensitiveBugReport &Report, TrackingOptions Opts={}, const StackFrameContext *Origin=nullptr)

Track how the value got stored into the given region and where it came from.

TrackingKind

Specifies the type of tracking for an expression.

Definition BugReporterVisitors.h:102

@ Thorough

Default tracking kind – specifies that as much information should be gathered about the tracked expre...

Definition BugReporterVisitors.h:105

@ Condition

Specifies that a more moderate tracking should be used for the expression value.

Definition BugReporterVisitors.h:110

IntrusiveRefCntPtr< const ProgramState > ProgramStateRef

std::shared_ptr< PathDiagnosticPiece > PathDiagnosticPieceRef

The JSON file list parser is used to communicate input to InstallAPI.

@ Result

The result type of a method or function.

@ Other

Other implicit parameter.

Describes how types, statements, expressions, and declarations should be printed.

Describes an event when the value got stored into a memory region.

Definition BugReporterVisitors.h:127

Kind

Definition BugReporterVisitors.h:128

@ Assignment

The value got stored into the region during assignment: int x; x = 42;.

Definition BugReporterVisitors.h:135

@ CallArgument

The value got stored into the parameter region as the result of a call.

Definition BugReporterVisitors.h:138

@ BlockCapture

The value got stored into the region as block capture.

Definition BugReporterVisitors.h:143

@ Initialization

The value got stored into the region during initialization: int x = 42;.

Definition BugReporterVisitors.h:131

const Expr * SourceOfTheValue

The expression where the value comes from.

Definition BugReporterVisitors.h:152

const MemRegion * Origin

Definition BugReporterVisitors.h:159

const ExplodedNode * StoreSite

The node where the store happened.

Definition BugReporterVisitors.h:149

Kind StoreKind

The type of store operation.

Definition BugReporterVisitors.h:147

SVal Value

Symbolic value that is being stored.

Definition BugReporterVisitors.h:154

const MemRegion * Dest

Memory regions involved in the store operation.

Definition BugReporterVisitors.h:159

Describes a tracking result with the most basic information of what was actually done (or not done).

Definition BugReporterVisitors.h:197

bool FoundSomethingToTrack

Usually it means that the tracker added visitors.

Definition BugReporterVisitors.h:199

void combineWith(const Result &Other)

Combines the current result with the given result.

Definition BugReporterVisitors.h:205

bool WasInterrupted

Signifies that the tracking was interrupted at some point.

Definition BugReporterVisitors.h:202

Defines a set of options altering tracking behavior.

Definition BugReporterVisitors.h:114

bool EnableNullFPSuppression

Specifies whether we should employ false positive suppression (inlined defensive checks,...

Definition BugReporterVisitors.h:119

TrackingKind Kind

Specifies the kind of tracking.

Definition BugReporterVisitors.h:116