CheckerManager.h revision 514f2c9dcb9e04b52929c5b141a6fe88bd68b33f 
1//===--- CheckerManager.h - Static Analyzer Checker Manager -----*- C++ -*-===//
2//
3//                     The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10// Defines the Static Analyzer Checker Manager.
11//
12//===----------------------------------------------------------------------===//
13
14#ifndef LLVM_CLANG_SA_CORE_CHECKERMANAGER_H
15#define LLVM_CLANG_SA_CORE_CHECKERMANAGER_H
16
17#include "clang/Basic/LangOptions.h"
18#include "llvm/ADT/SmallVector.h"
19#include "llvm/ADT/DenseMap.h"
20#include "llvm/ADT/FoldingSet.h"
21#include "clang/StaticAnalyzer/Core/PathSensitive/Store.h"
22#include "clang/Analysis/ProgramPoint.h"
23#include <vector>
24
25namespace clang {
26  class Decl;
27  class Stmt;
28  class CallExpr;
29
30namespace ento {
31  class CheckerBase;
32  class ExprEngine;
33  class AnalysisManager;
34  class BugReporter;
35  class CheckerContext;
36  class ObjCMessage;
37  class SVal;
38  class ExplodedNode;
39  class ExplodedNodeSet;
40  class ExplodedGraph;
41  class ProgramState;
42  class NodeBuilder;
43  struct NodeBuilderContext;
44  class MemRegion;
45  class SymbolReaper;
46
47class GraphExpander {
48public:
49  virtual ~GraphExpander();
50  virtual void expandGraph(ExplodedNodeSet &Dst, ExplodedNode *Pred) = 0;
51};
52
53template <typename T> class CheckerFn;
54
55template <typename RET, typename P1, typename P2, typename P3, typename P4,
56          typename P5>
57class CheckerFn<RET(P1, P2, P3, P4, P5)> {
58  typedef RET (*Func)(void *, P1, P2, P3, P4, P5);
59  Func Fn;
60public:
61  CheckerBase *Checker;
62  CheckerFn(CheckerBase *checker, Func fn) : Fn(fn), Checker(checker) { }
63  RET operator()(P1 p1, P2 p2, P3 p3, P4 p4, P5 p5) const {
64    return Fn(Checker, p1, p2, p3, p4, p5);
65  }
66};
67
68template <typename RET, typename P1, typename P2, typename P3, typename P4>
69class CheckerFn<RET(P1, P2, P3, P4)> {
70  typedef RET (*Func)(void *, P1, P2, P3, P4);
71  Func Fn;
72public:
73  CheckerBase *Checker;
74  CheckerFn(CheckerBase *checker, Func fn) : Fn(fn), Checker(checker) { }
75  RET operator()(P1 p1, P2 p2, P3 p3, P4 p4) const {
76    return Fn(Checker, p1, p2, p3, p4);
77  }
78};
79
80template <typename RET, typename P1, typename P2, typename P3>
81class CheckerFn<RET(P1, P2, P3)> {
82  typedef RET (*Func)(void *, P1, P2, P3);
83  Func Fn;
84public:
85  CheckerBase *Checker;
86  CheckerFn(CheckerBase *checker, Func fn) : Fn(fn), Checker(checker) { }
87  RET operator()(P1 p1, P2 p2, P3 p3) const { return Fn(Checker, p1, p2, p3); }
88};
89
90template <typename RET, typename P1, typename P2>
91class CheckerFn<RET(P1, P2)> {
92  typedef RET (*Func)(void *, P1, P2);
93  Func Fn;
94public:
95  CheckerBase *Checker;
96  CheckerFn(CheckerBase *checker, Func fn) : Fn(fn), Checker(checker) { }
97  RET operator()(P1 p1, P2 p2) const { return Fn(Checker, p1, p2); }
98};
99
100template <typename RET, typename P1>
101class CheckerFn<RET(P1)> {
102  typedef RET (*Func)(void *, P1);
103  Func Fn;
104public:
105  CheckerBase *Checker;
106  CheckerFn(CheckerBase *checker, Func fn) : Fn(fn), Checker(checker) { }
107  RET operator()(P1 p1) const { return Fn(Checker, p1); }
108};
109
110template <typename RET>
111class CheckerFn<RET()> {
112  typedef RET (*Func)(void *);
113  Func Fn;
114public:
115  CheckerBase *Checker;
116  CheckerFn(CheckerBase *checker, Func fn) : Fn(fn), Checker(checker) { }
117  RET operator()() const { return Fn(Checker); }
118};
119
120class CheckerManager {
121  const LangOptions LangOpts;
122
123public:
124  CheckerManager(const LangOptions &langOpts) : LangOpts(langOpts) { }
125  ~CheckerManager();
126
127  bool hasPathSensitiveCheckers() const;
128
129  void finishedCheckerRegistration();
130
131  const LangOptions &getLangOpts() const { return LangOpts; }
132
133  typedef CheckerBase *CheckerRef;
134  typedef const void *CheckerTag;
135  typedef CheckerFn<void ()> CheckerDtor;
136
137//===----------------------------------------------------------------------===//
138// registerChecker
139//===----------------------------------------------------------------------===//
140
141  /// \brief Used to register checkers.
142  ///
143  /// \returns a pointer to the checker object.
144  template <typename CHECKER>
145  CHECKER *registerChecker() {
146    CheckerTag tag = getTag<CHECKER>();
147    CheckerRef &ref = CheckerTags[tag];
148    if (ref)
149      return static_cast<CHECKER *>(ref); // already registered.
150
151    CHECKER *checker = new CHECKER();
152    CheckerDtors.push_back(CheckerDtor(checker, destruct<CHECKER>));
153    CHECKER::_register(checker, *this);
154    ref = checker;
155    return checker;
156  }
157
158//===----------------------------------------------------------------------===//
159// Functions for running checkers for AST traversing..
160//===----------------------------------------------------------------------===//
161
162  /// \brief Run checkers handling Decls.
163  void runCheckersOnASTDecl(const Decl *D, AnalysisManager& mgr,
164                            BugReporter &BR);
165
166  /// \brief Run checkers handling Decls containing a Stmt body.
167  void runCheckersOnASTBody(const Decl *D, AnalysisManager& mgr,
168                            BugReporter &BR);
169
170//===----------------------------------------------------------------------===//
171// Functions for running checkers for path-sensitive checking.
172//===----------------------------------------------------------------------===//
173
174  /// \brief Run checkers for pre-visiting Stmts.
175  ///
176  /// The notification is performed for every explored CFGElement, which does
177  /// not include the control flow statements such as IfStmt.
178  ///
179  /// \sa runCheckersForBranchCondition, runCheckersForPostStmt
180  void runCheckersForPreStmt(ExplodedNodeSet &Dst,
181                             const ExplodedNodeSet &Src,
182                             const Stmt *S,
183                             ExprEngine &Eng) {
184    runCheckersForStmt(/*isPreVisit=*/true, Dst, Src, S, Eng);
185  }
186
187  /// \brief Run checkers for post-visiting Stmts.
188  ///
189  /// The notification is performed for every explored CFGElement, which does
190  /// not include the control flow statements such as IfStmt.
191  ///
192  /// \sa runCheckersForBranchCondition, runCheckersForPreStmt
193  void runCheckersForPostStmt(ExplodedNodeSet &Dst,
194                              const ExplodedNodeSet &Src,
195                              const Stmt *S,
196                              ExprEngine &Eng,
197                              bool wasInlined = false) {
198    runCheckersForStmt(/*isPreVisit=*/false, Dst, Src, S, Eng, wasInlined);
199  }
200
201  /// \brief Run checkers for visiting Stmts.
202  void runCheckersForStmt(bool isPreVisit,
203                          ExplodedNodeSet &Dst, const ExplodedNodeSet &Src,
204                          const Stmt *S, ExprEngine &Eng,
205                          bool wasInlined = false);
206
207  /// \brief Run checkers for pre-visiting obj-c messages.
208  void runCheckersForPreObjCMessage(ExplodedNodeSet &Dst,
209                                    const ExplodedNodeSet &Src,
210                                    const ObjCMessage &msg,
211                                    ExprEngine &Eng) {
212    runCheckersForObjCMessage(/*isPreVisit=*/true, Dst, Src, msg, Eng);
213  }
214
215  /// \brief Run checkers for post-visiting obj-c messages.
216  void runCheckersForPostObjCMessage(ExplodedNodeSet &Dst,
217                                     const ExplodedNodeSet &Src,
218                                     const ObjCMessage &msg,
219                                     ExprEngine &Eng) {
220    runCheckersForObjCMessage(/*isPreVisit=*/false, Dst, Src, msg, Eng);
221  }
222
223  /// \brief Run checkers for visiting obj-c messages.
224  void runCheckersForObjCMessage(bool isPreVisit,
225                                 ExplodedNodeSet &Dst,
226                                 const ExplodedNodeSet &Src,
227                                 const ObjCMessage &msg, ExprEngine &Eng);
228
229  /// \brief Run checkers for load/store of a location.
230  void runCheckersForLocation(ExplodedNodeSet &Dst,
231                              const ExplodedNodeSet &Src,
232                              SVal location, bool isLoad,
233                              const Stmt *S,
234                              ExprEngine &Eng);
235
236  /// \brief Run checkers for binding of a value to a location.
237  void runCheckersForBind(ExplodedNodeSet &Dst,
238                          const ExplodedNodeSet &Src,
239                          SVal location, SVal val,
240                          const Stmt *S, ExprEngine &Eng,
241                          ProgramPoint::Kind PointKind);
242
243  /// \brief Run checkers for end of analysis.
244  void runCheckersForEndAnalysis(ExplodedGraph &G, BugReporter &BR,
245                                 ExprEngine &Eng);
246
247  /// \brief Run checkers for end of path.
248  void runCheckersForEndPath(NodeBuilderContext &BC,
249                             ExplodedNodeSet &Dst,
250                             ExprEngine &Eng);
251
252  /// \brief Run checkers for branch condition.
253  void runCheckersForBranchCondition(const Stmt *condition,
254                                     ExplodedNodeSet &Dst, ExplodedNode *Pred,
255                                     ExprEngine &Eng);
256
257  /// \brief Run checkers for live symbols.
258  ///
259  /// Allows modifying SymbolReaper object. For example, checkers can explicitly
260  /// register symbols of interest as live. These symbols will not be marked
261  /// dead and removed.
262  void runCheckersForLiveSymbols(ProgramStateRef state,
263                                 SymbolReaper &SymReaper);
264
265  /// \brief Run checkers for dead symbols.
266  ///
267  /// Notifies checkers when symbols become dead. For example, this allows
268  /// checkers to aggressively clean up/reduce the checker state and produce
269  /// precise diagnostics.
270  void runCheckersForDeadSymbols(ExplodedNodeSet &Dst,
271                                 const ExplodedNodeSet &Src,
272                                 SymbolReaper &SymReaper, const Stmt *S,
273                                 ExprEngine &Eng);
274
275  /// \brief True if at least one checker wants to check region changes.
276  bool wantsRegionChangeUpdate(ProgramStateRef state);
277
278  /// \brief Run checkers for region changes.
279  ///
280  /// This corresponds to the check::RegionChanges callback.
281  /// \param state The current program state.
282  /// \param invalidated A set of all symbols potentially touched by the change.
283  /// \param ExplicitRegions The regions explicitly requested for invalidation.
284  ///   For example, in the case of a function call, these would be arguments.
285  /// \param Regions The transitive closure of accessible regions,
286  ///   i.e. all regions that may have been touched by this change.
287  /// \param The call expression wrapper if the regions are invalidated by a
288  ///   call.
289  ProgramStateRef
290  runCheckersForRegionChanges(ProgramStateRef state,
291                            const StoreManager::InvalidatedSymbols *invalidated,
292                              ArrayRef<const MemRegion *> ExplicitRegions,
293                              ArrayRef<const MemRegion *> Regions,
294                              const CallOrObjCMessage *Call);
295
296  /// \brief Run checkers for handling assumptions on symbolic values.
297  ProgramStateRef runCheckersForEvalAssume(ProgramStateRef state,
298                                               SVal Cond, bool Assumption);
299
300  /// \brief Run checkers for evaluating a call.
301  void runCheckersForEvalCall(ExplodedNodeSet &Dst,
302                              const ExplodedNodeSet &Src,
303                              const CallExpr *CE, ExprEngine &Eng,
304                              GraphExpander *defaultEval = 0);
305
306  /// \brief Run checkers for the entire Translation Unit.
307  void runCheckersOnEndOfTranslationUnit(const TranslationUnitDecl *TU,
308                                         AnalysisManager &mgr,
309                                         BugReporter &BR);
310
311  /// \brief Run checkers for debug-printing a ProgramState.
312  ///
313  /// Unlike most other callbacks, any checker can simply implement the virtual
314  /// method CheckerBase::printState if it has custom data to print.
315  /// \param Out The output stream
316  /// \param State The state being printed
317  /// \param NL The preferred representation of a newline.
318  /// \param Sep The preferred separator between different kinds of data.
319  void runCheckersForPrintState(raw_ostream &Out, ProgramStateRef State,
320                                const char *NL, const char *Sep);
321
322//===----------------------------------------------------------------------===//
323// Internal registration functions for AST traversing.
324//===----------------------------------------------------------------------===//
325
326  // Functions used by the registration mechanism, checkers should not touch
327  // these directly.
328
329  typedef CheckerFn<void (const Decl *, AnalysisManager&, BugReporter &)>
330      CheckDeclFunc;
331
332  typedef bool (*HandlesDeclFunc)(const Decl *D);
333  void _registerForDecl(CheckDeclFunc checkfn, HandlesDeclFunc isForDeclFn);
334
335  void _registerForBody(CheckDeclFunc checkfn);
336
337//===----------------------------------------------------------------------===//
338// Internal registration functions for path-sensitive checking.
339//===----------------------------------------------------------------------===//
340
341  typedef CheckerFn<void (const Stmt *, CheckerContext &)> CheckStmtFunc;
342
343  typedef CheckerFn<void (const ObjCMessage &, CheckerContext &)>
344      CheckObjCMessageFunc;
345
346  typedef CheckerFn<void (const SVal &location, bool isLoad, const Stmt *S,
347                          CheckerContext &)>
348      CheckLocationFunc;
349
350  typedef CheckerFn<void (const SVal &location, const SVal &val,
351                          const Stmt *S, CheckerContext &)>
352      CheckBindFunc;
353
354  typedef CheckerFn<void (ExplodedGraph &, BugReporter &, ExprEngine &)>
355      CheckEndAnalysisFunc;
356
357  typedef CheckerFn<void (CheckerContext &)>
358      CheckEndPathFunc;
359
360  typedef CheckerFn<void (const Stmt *, CheckerContext &)>
361      CheckBranchConditionFunc;
362
363  typedef CheckerFn<void (SymbolReaper &, CheckerContext &)>
364      CheckDeadSymbolsFunc;
365
366  typedef CheckerFn<void (ProgramStateRef,SymbolReaper &)> CheckLiveSymbolsFunc;
367
368  typedef CheckerFn<ProgramStateRef (ProgramStateRef,
369                                const StoreManager::InvalidatedSymbols *symbols,
370                                ArrayRef<const MemRegion *> ExplicitRegions,
371                                ArrayRef<const MemRegion *> Regions,
372                                const CallOrObjCMessage *Call)>
373      CheckRegionChangesFunc;
374
375  typedef CheckerFn<bool (ProgramStateRef)> WantsRegionChangeUpdateFunc;
376
377  typedef CheckerFn<ProgramStateRef (ProgramStateRef,
378                                          const SVal &cond, bool assumption)>
379      EvalAssumeFunc;
380
381  typedef CheckerFn<bool (const CallExpr *, CheckerContext &)>
382      EvalCallFunc;
383
384  typedef CheckerFn<bool (const CallExpr *, ExprEngine &Eng,
385                                            ExplodedNode *Pred,
386                                            ExplodedNodeSet &Dst)>
387      InlineCallFunc;
388
389  typedef CheckerFn<void (const TranslationUnitDecl *,
390                          AnalysisManager&, BugReporter &)>
391      CheckEndOfTranslationUnit;
392
393  typedef bool (*HandlesStmtFunc)(const Stmt *D);
394  void _registerForPreStmt(CheckStmtFunc checkfn,
395                           HandlesStmtFunc isForStmtFn);
396  void _registerForPostStmt(CheckStmtFunc checkfn,
397                            HandlesStmtFunc isForStmtFn);
398
399  void _registerForPreObjCMessage(CheckObjCMessageFunc checkfn);
400  void _registerForPostObjCMessage(CheckObjCMessageFunc checkfn);
401
402  void _registerForLocation(CheckLocationFunc checkfn);
403
404  void _registerForBind(CheckBindFunc checkfn);
405
406  void _registerForEndAnalysis(CheckEndAnalysisFunc checkfn);
407
408  void _registerForEndPath(CheckEndPathFunc checkfn);
409
410  void _registerForBranchCondition(CheckBranchConditionFunc checkfn);
411
412  void _registerForLiveSymbols(CheckLiveSymbolsFunc checkfn);
413
414  void _registerForDeadSymbols(CheckDeadSymbolsFunc checkfn);
415
416  void _registerForRegionChanges(CheckRegionChangesFunc checkfn,
417                                 WantsRegionChangeUpdateFunc wantUpdateFn);
418
419  void _registerForEvalAssume(EvalAssumeFunc checkfn);
420
421  void _registerForEvalCall(EvalCallFunc checkfn);
422
423  void _registerForInlineCall(InlineCallFunc checkfn);
424
425  void _registerForEndOfTranslationUnit(CheckEndOfTranslationUnit checkfn);
426
427//===----------------------------------------------------------------------===//
428// Internal registration functions for events.
429//===----------------------------------------------------------------------===//
430
431  typedef void *EventTag;
432  typedef CheckerFn<void (const void *event)> CheckEventFunc;
433
434  template <typename EVENT>
435  void _registerListenerForEvent(CheckEventFunc checkfn) {
436    EventInfo &info = Events[getTag<EVENT>()];
437    info.Checkers.push_back(checkfn);
438  }
439
440  template <typename EVENT>
441  void _registerDispatcherForEvent() {
442    EventInfo &info = Events[getTag<EVENT>()];
443    info.HasDispatcher = true;
444  }
445
446  template <typename EVENT>
447  void _dispatchEvent(const EVENT &event) const {
448    EventsTy::const_iterator I = Events.find(getTag<EVENT>());
449    if (I == Events.end())
450      return;
451    const EventInfo &info = I->second;
452    for (unsigned i = 0, e = info.Checkers.size(); i != e; ++i)
453      info.Checkers[i](&event);
454  }
455
456//===----------------------------------------------------------------------===//
457// Implementation details.
458//===----------------------------------------------------------------------===//
459
460private:
461  template <typename CHECKER>
462  static void destruct(void *obj) { delete static_cast<CHECKER *>(obj); }
463
464  template <typename T>
465  static void *getTag() { static int tag; return &tag; }
466
467  llvm::DenseMap<CheckerTag, CheckerRef> CheckerTags;
468
469  std::vector<CheckerDtor> CheckerDtors;
470
471  struct DeclCheckerInfo {
472    CheckDeclFunc CheckFn;
473    HandlesDeclFunc IsForDeclFn;
474  };
475  std::vector<DeclCheckerInfo> DeclCheckers;
476
477  std::vector<CheckDeclFunc> BodyCheckers;
478
479  typedef SmallVector<CheckDeclFunc, 4> CachedDeclCheckers;
480  typedef llvm::DenseMap<unsigned, CachedDeclCheckers> CachedDeclCheckersMapTy;
481  CachedDeclCheckersMapTy CachedDeclCheckersMap;
482
483  struct StmtCheckerInfo {
484    CheckStmtFunc CheckFn;
485    HandlesStmtFunc IsForStmtFn;
486    bool IsPreVisit;
487  };
488  std::vector<StmtCheckerInfo> StmtCheckers;
489
490  struct CachedStmtCheckersKey {
491    unsigned StmtKind;
492    bool IsPreVisit;
493
494    CachedStmtCheckersKey() : StmtKind(0), IsPreVisit(0) { }
495    CachedStmtCheckersKey(unsigned stmtKind, bool isPreVisit)
496      : StmtKind(stmtKind), IsPreVisit(isPreVisit) { }
497
498    static CachedStmtCheckersKey getSentinel() {
499      return CachedStmtCheckersKey(~0U, 0);
500    }
501    unsigned getHashValue() const {
502      llvm::FoldingSetNodeID ID;
503      ID.AddInteger(StmtKind);
504      ID.AddBoolean(IsPreVisit);
505      return ID.ComputeHash();
506    }
507    bool operator==(const CachedStmtCheckersKey &RHS) const {
508      return StmtKind == RHS.StmtKind && IsPreVisit == RHS.IsPreVisit;
509    }
510  };
511  friend struct llvm::DenseMapInfo<CachedStmtCheckersKey>;
512
513  typedef SmallVector<CheckStmtFunc, 4> CachedStmtCheckers;
514  typedef llvm::DenseMap<CachedStmtCheckersKey, CachedStmtCheckers>
515      CachedStmtCheckersMapTy;
516  CachedStmtCheckersMapTy CachedStmtCheckersMap;
517
518  CachedStmtCheckers *getCachedStmtCheckersFor(const Stmt *S, bool isPreVisit);
519
520  std::vector<CheckObjCMessageFunc> PreObjCMessageCheckers;
521  std::vector<CheckObjCMessageFunc> PostObjCMessageCheckers;
522
523  std::vector<CheckLocationFunc> LocationCheckers;
524
525  std::vector<CheckBindFunc> BindCheckers;
526
527  std::vector<CheckEndAnalysisFunc> EndAnalysisCheckers;
528
529  std::vector<CheckEndPathFunc> EndPathCheckers;
530
531  std::vector<CheckBranchConditionFunc> BranchConditionCheckers;
532
533  std::vector<CheckLiveSymbolsFunc> LiveSymbolsCheckers;
534
535  std::vector<CheckDeadSymbolsFunc> DeadSymbolsCheckers;
536
537  struct RegionChangesCheckerInfo {
538    CheckRegionChangesFunc CheckFn;
539    WantsRegionChangeUpdateFunc WantUpdateFn;
540  };
541  std::vector<RegionChangesCheckerInfo> RegionChangesCheckers;
542
543  std::vector<EvalAssumeFunc> EvalAssumeCheckers;
544
545  std::vector<EvalCallFunc> EvalCallCheckers;
546
547  std::vector<InlineCallFunc> InlineCallCheckers;
548
549  std::vector<CheckEndOfTranslationUnit> EndOfTranslationUnitCheckers;
550
551  struct EventInfo {
552    SmallVector<CheckEventFunc, 4> Checkers;
553    bool HasDispatcher;
554    EventInfo() : HasDispatcher(false) { }
555  };
556
557  typedef llvm::DenseMap<EventTag, EventInfo> EventsTy;
558  EventsTy Events;
559};
560
561} // end ento namespace
562
563} // end clang namespace
564
565namespace llvm {
566  /// Define DenseMapInfo so that CachedStmtCheckersKey can be used as key
567  /// in DenseMap and DenseSets.
568  template <>
569  struct DenseMapInfo<clang::ento::CheckerManager::CachedStmtCheckersKey> {
570    static inline clang::ento::CheckerManager::CachedStmtCheckersKey
571        getEmptyKey() {
572      return clang::ento::CheckerManager::CachedStmtCheckersKey();
573    }
574    static inline clang::ento::CheckerManager::CachedStmtCheckersKey
575        getTombstoneKey() {
576      return clang::ento::CheckerManager::CachedStmtCheckersKey::getSentinel();
577    }
578
579    static unsigned
580        getHashValue(clang::ento::CheckerManager::CachedStmtCheckersKey S) {
581      return S.getHashValue();
582    }
583
584    static bool isEqual(clang::ento::CheckerManager::CachedStmtCheckersKey LHS,
585                       clang::ento::CheckerManager::CachedStmtCheckersKey RHS) {
586      return LHS == RHS;
587    }
588  };
589} // end namespace llvm
590
591#endif
592