CheckerContext.h revision 0a6e09f67c719c318856be19d57e19972101f62c
12a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)//== CheckerContext.h - Context info for path-sensitive checkers--*- C++ -*--=// 22a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)// 32a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)// The LLVM Compiler Infrastructure 42a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)// 52a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)// This file is distributed under the University of Illinois Open Source 62a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)// License. See LICENSE.TXT for details. 72a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)// 890dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)//===----------------------------------------------------------------------===// 990dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)// 102a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)// This file defines CheckerContext that provides contextual info for 115e3f23d412006dc4db4e659864679f29341e113fTorne (Richard Coles)// path-sensitive checkers. 12eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch// 132a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)//===----------------------------------------------------------------------===// 14d0247b1b59f9c528cb6df88b4f2b9afaf80d181eTorne (Richard Coles) 152a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)#ifndef LLVM_CLANG_SA_CORE_PATHSENSITIVE_CHECKERCONTEXT 162a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)#define LLVM_CLANG_SA_CORE_PATHSENSITIVE_CHECKERCONTEXT 17effb81e5f8246d0db0270817048dc992db66e9fbBen Murdoch 182a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h" 192a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h" 202a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 212a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)namespace clang { 222a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)namespace ento { 232a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 242a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) /// Declares an immutable map of type \p NameTy, suitable for placement into 252a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) /// the ProgramState. This is implementing using llvm::ImmutableMap. 264e180b6a0b4720a9b8e9e959a882386f690f08ffTorne (Richard Coles) /// 274e180b6a0b4720a9b8e9e959a882386f690f08ffTorne (Richard Coles) /// \code 282a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) /// State = State->set<Name>(K, V); 292a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) /// const Value *V = State->get<Name>(K); // Returns NULL if not in the map. 302a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) /// State = State->remove<Name>(K); 312a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) /// NameTy Map = State->get<Name>(); 324e180b6a0b4720a9b8e9e959a882386f690f08ffTorne (Richard Coles) /// \endcode 332a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) /// 342a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) /// The macro should not be used inside namespaces, or for traits that must 352a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) /// be accessible from more than one translation unit. 362a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) #define REGISTER_MAP_WITH_PROGRAMSTATE(Name, Key, Value) \ 374e180b6a0b4720a9b8e9e959a882386f690f08ffTorne (Richard Coles) REGISTER_TRAIT_WITH_PROGRAMSTATE(Name, \ 382a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) CLANG_ENTO_PROGRAMSTATE_MAP(Key, Value)) 392a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 402a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) /// Declares an immutable set of type \p NameTy, suitable for placement into 412a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) /// the ProgramState. This is implementing using llvm::ImmutableSet. 4290dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) /// 4390dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) /// \code 442a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) /// State = State->add<Name>(E); 452a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) /// State = State->remove<Name>(E); 462a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) /// bool Present = State->contains<Name>(E); 472a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) /// NameTy Set = State->get<Name>(); 482a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) /// \endcode 492a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) /// 502a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) /// The macro should not be used inside namespaces, or for traits that must 512a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) /// be accessible from more than one translation unit. 522a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) #define REGISTER_SET_WITH_PROGRAMSTATE(Name, Elem) \ 532a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) REGISTER_TRAIT_WITH_PROGRAMSTATE(Name, llvm::ImmutableSet<Elem>) 542a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 552a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) /// Declares an immutable list of type \p NameTy, suitable for placement into 562a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) /// the ProgramState. This is implementing using llvm::ImmutableList. 572a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) /// 582a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) /// \code 592a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) /// State = State->add<Name>(E); // Adds to the /end/ of the list. 602a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) /// bool Present = State->contains<Name>(E); 612a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) /// NameTy List = State->get<Name>(); 622a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) /// \endcode 632a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) /// 64f8ee788a64d60abd8f2d742a5fdedde054ecd910Torne (Richard Coles) /// The macro should not be used inside namespaces, or for traits that must 652a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) /// be accessible from more than one translation unit. 662a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) #define REGISTER_LIST_WITH_PROGRAMSTATE(Name, Elem) \ 672a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) REGISTER_TRAIT_WITH_PROGRAMSTATE(Name, llvm::ImmutableList<Elem>) 682a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 692a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 702a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)class CheckerContext { 712a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) ExprEngine &Eng; 722a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) /// The current exploded(symbolic execution) graph node. 732a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) ExplodedNode *Pred; 742a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) /// The flag is true if the (state of the execution) has been modified 7590dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) /// by the checker using this context. For example, a new transition has been 7690dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) /// added or a bug report issued. 775d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) bool Changed; 785d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) /// The tagged location, which is used to generate all new nodes. 795d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) const ProgramPoint Location; 805d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) NodeBuilder &NB; 815d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 822a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)public: 834e180b6a0b4720a9b8e9e959a882386f690f08ffTorne (Richard Coles) /// If we are post visiting a call, this flag will be set if the 84f8ee788a64d60abd8f2d742a5fdedde054ecd910Torne (Richard Coles) /// call was inlined. In all other cases it will be false. 852a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) const bool wasInlined; 862a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 872a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) CheckerContext(NodeBuilder &builder, 884e180b6a0b4720a9b8e9e959a882386f690f08ffTorne (Richard Coles) ExprEngine &eng, 892a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) ExplodedNode *pred, 902a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) const ProgramPoint &loc, 912a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) bool wasInlined = false) 922a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) : Eng(eng), 932a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) Pred(pred), 942a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) Changed(false), 952a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) Location(loc), 962a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) NB(builder), 972a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) wasInlined(wasInlined) { 981e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) assert(Pred->getState() && 992a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) "We should not call the checkers on an empty state."); 1002a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) } 1012a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 1022a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) AnalysisManager &getAnalysisManager() { 10390dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) return Eng.getAnalysisManager(); 10490dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) } 1052a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 1062a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) ConstraintManager &getConstraintManager() { 1072a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return Eng.getConstraintManager(); 1082a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) } 1092a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 1102a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) StoreManager &getStoreManager() { 1112a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return Eng.getStoreManager(); 112 } 113 114 const AnalyzerOptions::ConfigTable &getConfig() const { 115 return Eng.getAnalysisManager().options.Config; 116 } 117 118 /// \brief Returns the previous node in the exploded graph, which includes 119 /// the state of the program before the checker ran. Note, checkers should 120 /// not retain the node in their state since the nodes might get invalidated. 121 ExplodedNode *getPredecessor() { return Pred; } 122 const ProgramStateRef &getState() const { return Pred->getState(); } 123 124 /// \brief Check if the checker changed the state of the execution; ex: added 125 /// a new transition or a bug report. 126 bool isDifferent() { return Changed; } 127 128 /// \brief Returns the number of times the current block has been visited 129 /// along the analyzed path. 130 unsigned blockCount() const { 131 return NB.getContext().blockCount(); 132 } 133 134 ASTContext &getASTContext() { 135 return Eng.getContext(); 136 } 137 138 const LangOptions &getLangOpts() const { 139 return Eng.getContext().getLangOpts(); 140 } 141 142 const LocationContext *getLocationContext() const { 143 return Pred->getLocationContext(); 144 } 145 146 const StackFrameContext *getStackFrame() const { 147 return Pred->getStackFrame(); 148 } 149 150 /// Return true if the current LocationContext has no caller context. 151 bool inTopFrame() const { return getLocationContext()->inTopFrame(); } 152 153 BugReporter &getBugReporter() { 154 return Eng.getBugReporter(); 155 } 156 157 SourceManager &getSourceManager() { 158 return getBugReporter().getSourceManager(); 159 } 160 161 SValBuilder &getSValBuilder() { 162 return Eng.getSValBuilder(); 163 } 164 165 SymbolManager &getSymbolManager() { 166 return getSValBuilder().getSymbolManager(); 167 } 168 169 bool isObjCGCEnabled() const { 170 return Eng.isObjCGCEnabled(); 171 } 172 173 ProgramStateManager &getStateManager() { 174 return Eng.getStateManager(); 175 } 176 177 AnalysisDeclContext *getCurrentAnalysisDeclContext() const { 178 return Pred->getLocationContext()->getAnalysisDeclContext(); 179 } 180 181 /// \brief If the given node corresponds to a PostStore program point, retrieve 182 /// the location region as it was uttered in the code. 183 /// 184 /// This utility can be useful for generating extensive diagnostics, for 185 /// example, for finding variables that the given symbol was assigned to. 186 static const MemRegion *getLocationRegionIfPostStore(const ExplodedNode *N) { 187 ProgramPoint L = N->getLocation(); 188 if (const PostStore *PSL = dyn_cast<PostStore>(&L)) 189 return reinterpret_cast<const MemRegion*>(PSL->getLocationValue()); 190 return 0; 191 } 192 193 /// \brief Get the value of arbitrary expressions at this point in the path. 194 SVal getSVal(const Stmt *S) const { 195 return getState()->getSVal(S, getLocationContext()); 196 } 197 198 /// \brief Generates a new transition in the program state graph 199 /// (ExplodedGraph). Uses the default CheckerContext predecessor node. 200 /// 201 /// @param State The state of the generated node. If not specified, the state 202 /// will not be changed, but the new node will have the checker's tag. 203 /// @param Tag The tag is used to uniquely identify the creation site. If no 204 /// tag is specified, a default tag, unique to the given checker, 205 /// will be used. Tags are used to prevent states generated at 206 /// different sites from caching out. 207 ExplodedNode *addTransition(ProgramStateRef State = 0, 208 const ProgramPointTag *Tag = 0) { 209 return addTransitionImpl(State ? State : getState(), false, 0, Tag); 210 } 211 212 /// \brief Generates a new transition with the given predecessor. 213 /// Allows checkers to generate a chain of nodes. 214 /// 215 /// @param State The state of the generated node. 216 /// @param Pred The transition will be generated from the specified Pred node 217 /// to the newly generated node. 218 /// @param Tag The tag to uniquely identify the creation site. 219 ExplodedNode *addTransition(ProgramStateRef State, 220 ExplodedNode *Pred, 221 const ProgramPointTag *Tag = 0) { 222 return addTransitionImpl(State, false, Pred, Tag); 223 } 224 225 /// \brief Generate a sink node. Generating a sink stops exploration of the 226 /// given path. 227 ExplodedNode *generateSink(ProgramStateRef State = 0, 228 ExplodedNode *Pred = 0, 229 const ProgramPointTag *Tag = 0) { 230 return addTransitionImpl(State ? State : getState(), true, Pred, Tag); 231 } 232 233 /// \brief Emit the diagnostics report. 234 void emitReport(BugReport *R) { 235 Changed = true; 236 Eng.getBugReporter().emitReport(R); 237 } 238 239 /// \brief Get the declaration of the called function (path-sensitive). 240 const FunctionDecl *getCalleeDecl(const CallExpr *CE) const; 241 242 /// \brief Get the name of the called function (path-sensitive). 243 StringRef getCalleeName(const FunctionDecl *FunDecl) const; 244 245 /// \brief Get the identifier of the called function (path-sensitive). 246 const IdentifierInfo *getCalleeIdentifier(const CallExpr *CE) const { 247 const FunctionDecl *FunDecl = getCalleeDecl(CE); 248 if (FunDecl) 249 return FunDecl->getIdentifier(); 250 else 251 return 0; 252 } 253 254 /// \brief Get the name of the called function (path-sensitive). 255 StringRef getCalleeName(const CallExpr *CE) const { 256 const FunctionDecl *FunDecl = getCalleeDecl(CE); 257 return getCalleeName(FunDecl); 258 } 259 260 /// \brief Returns true if the callee is an externally-visible function in the 261 /// top-level namespace, such as \c malloc. 262 /// 263 /// If a name is provided, the function must additionally match the given 264 /// name. 265 /// 266 /// Note that this deliberately excludes C++ library functions in the \c std 267 /// namespace, but will include C library functions accessed through the 268 /// \c std namespace. This also does not check if the function is declared 269 /// as 'extern "C"', or if it uses C++ name mangling. 270 static bool isCLibraryFunction(const FunctionDecl *FD, 271 StringRef Name = StringRef()); 272 273 /// \brief Depending on wither the location corresponds to a macro, return 274 /// either the macro name or the token spelling. 275 /// 276 /// This could be useful when checkers' logic depends on whether a function 277 /// is called with a given macro argument. For example: 278 /// s = socket(AF_INET,..) 279 /// If AF_INET is a macro, the result should be treated as a source of taint. 280 /// 281 /// \sa clang::Lexer::getSpelling(), clang::Lexer::getImmediateMacroName(). 282 StringRef getMacroNameOrSpelling(SourceLocation &Loc); 283 284private: 285 ExplodedNode *addTransitionImpl(ProgramStateRef State, 286 bool MarkAsSink, 287 ExplodedNode *P = 0, 288 const ProgramPointTag *Tag = 0) { 289 if (!State || (State == Pred->getState() && !Tag && !MarkAsSink)) 290 return Pred; 291 292 Changed = true; 293 const ProgramPoint &LocalLoc = (Tag ? Location.withTag(Tag) : Location); 294 if (!P) 295 P = Pred; 296 297 ExplodedNode *node; 298 if (MarkAsSink) 299 node = NB.generateSink(LocalLoc, State, P); 300 else 301 node = NB.generateNode(LocalLoc, State, P); 302 return node; 303 } 304}; 305 306/// \brief A helper class which wraps a boolean value set to false by default. 307struct DefaultBool { 308 bool Val; 309 DefaultBool() : Val(false) {} 310 operator bool() const { return Val; } 311 DefaultBool &operator=(bool b) { Val = b; return *this; } 312}; 313 314} // end GR namespace 315 316} // end clang namespace 317 318#endif 319