CheckerContext.h revision 2f3017f9cbd3774f690c979410bfec38423d03af
1//== CheckerContext.h - Context info for path-sensitive checkers--*- C++ -*--=// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// This file defines CheckerContext that provides contextual info for 11// path-sensitive checkers. 12// 13//===----------------------------------------------------------------------===// 14 15#ifndef LLVM_CLANG_SA_CORE_PATHSENSITIVE_CHECKERCONTEXT 16#define LLVM_CLANG_SA_CORE_PATHSENSITIVE_CHECKERCONTEXT 17 18#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h" 19 20namespace clang { 21namespace ento { 22 23class CheckerContext { 24 ExprEngine &Eng; 25 /// The current exploded(symbolic execution) graph node. 26 ExplodedNode *Pred; 27 /// The flag is true if the (state of the execution) has been modified 28 /// by the checker using this context. For example, a new transition has been 29 /// added or a bug report issued. 30 bool Changed; 31 /// The tagged location, which is used to generate all new nodes. 32 const ProgramPoint Location; 33 NodeBuilder &NB; 34 35public: 36 /// If we are post visiting a call, this flag will be set if the 37 /// call was inlined. In all other cases it will be false. 38 const bool wasInlined; 39 40 CheckerContext(NodeBuilder &builder, 41 ExprEngine &eng, 42 ExplodedNode *pred, 43 const ProgramPoint &loc, 44 bool wasInlined = false) 45 : Eng(eng), 46 Pred(pred), 47 Changed(false), 48 Location(loc), 49 NB(builder), 50 wasInlined(wasInlined) { 51 assert(Pred->getState() && 52 "We should not call the checkers on an empty state."); 53 } 54 55 AnalysisManager &getAnalysisManager() { 56 return Eng.getAnalysisManager(); 57 } 58 59 ConstraintManager &getConstraintManager() { 60 return Eng.getConstraintManager(); 61 } 62 63 StoreManager &getStoreManager() { 64 return Eng.getStoreManager(); 65 } 66 67 const AnalyzerOptions::ConfigTable &getConfig() const { 68 return Eng.getAnalysisManager().options.Config; 69 } 70 71 /// \brief Returns the previous node in the exploded graph, which includes 72 /// the state of the program before the checker ran. Note, checkers should 73 /// not retain the node in their state since the nodes might get invalidated. 74 ExplodedNode *getPredecessor() { return Pred; } 75 ProgramStateRef getState() const { return Pred->getState(); } 76 77 /// \brief Check if the checker changed the state of the execution; ex: added 78 /// a new transition or a bug report. 79 bool isDifferent() { return Changed; } 80 81 /// \brief Returns the number of times the current block has been visited 82 /// along the analyzed path. 83 unsigned blockCount() const { 84 return NB.getContext().blockCount(); 85 } 86 87 ASTContext &getASTContext() { 88 return Eng.getContext(); 89 } 90 91 const LangOptions &getLangOpts() const { 92 return Eng.getContext().getLangOpts(); 93 } 94 95 const LocationContext *getLocationContext() const { 96 return Pred->getLocationContext(); 97 } 98 99 const StackFrameContext *getStackFrame() const { 100 return Pred->getStackFrame(); 101 } 102 103 /// Returns true if the predecessor is within an inlined function/method. 104 bool isWithinInlined() { 105 return (getStackFrame()->getParent() != 0); 106 } 107 108 BugReporter &getBugReporter() { 109 return Eng.getBugReporter(); 110 } 111 112 SourceManager &getSourceManager() { 113 return getBugReporter().getSourceManager(); 114 } 115 116 SValBuilder &getSValBuilder() { 117 return Eng.getSValBuilder(); 118 } 119 120 SymbolManager &getSymbolManager() { 121 return getSValBuilder().getSymbolManager(); 122 } 123 124 bool isObjCGCEnabled() const { 125 return Eng.isObjCGCEnabled(); 126 } 127 128 ProgramStateManager &getStateManager() { 129 return Eng.getStateManager(); 130 } 131 132 AnalysisDeclContext *getCurrentAnalysisDeclContext() const { 133 return Pred->getLocationContext()->getAnalysisDeclContext(); 134 } 135 136 /// \brief If the given node corresponds to a PostStore program point, retrieve 137 /// the location region as it was uttered in the code. 138 /// 139 /// This utility can be useful for generating extensive diagnostics, for 140 /// example, for finding variables that the given symbol was assigned to. 141 static const MemRegion *getLocationRegionIfPostStore(const ExplodedNode *N) { 142 ProgramPoint L = N->getLocation(); 143 if (const PostStore *PSL = dyn_cast<PostStore>(&L)) 144 return reinterpret_cast<const MemRegion*>(PSL->getLocationValue()); 145 return 0; 146 } 147 148 /// \brief Get the value of arbitrary expressions at this point in the path. 149 SVal getSVal(const Stmt *S) const { 150 return getState()->getSVal(S, getLocationContext()); 151 } 152 153 /// \brief Generates a new transition in the program state graph 154 /// (ExplodedGraph). Uses the default CheckerContext predecessor node. 155 /// 156 /// @param State The state of the generated node. If not specified, the state 157 /// will not be changed, but the new node will have the checker's tag. 158 /// @param Tag The tag is used to uniquely identify the creation site. If no 159 /// tag is specified, a default tag, unique to the given checker, 160 /// will be used. Tags are used to prevent states generated at 161 /// different sites from caching out. 162 ExplodedNode *addTransition(ProgramStateRef State = 0, 163 const ProgramPointTag *Tag = 0) { 164 return addTransitionImpl(State ? State : getState(), false, 0, Tag); 165 } 166 167 /// \brief Generates a new transition with the given predecessor. 168 /// Allows checkers to generate a chain of nodes. 169 /// 170 /// @param State The state of the generated node. 171 /// @param Pred The transition will be generated from the specified Pred node 172 /// to the newly generated node. 173 /// @param Tag The tag to uniquely identify the creation site. 174 ExplodedNode *addTransition(ProgramStateRef State, 175 ExplodedNode *Pred, 176 const ProgramPointTag *Tag = 0) { 177 return addTransitionImpl(State, false, Pred, Tag); 178 } 179 180 /// \brief Generate a sink node. Generating a sink stops exploration of the 181 /// given path. 182 ExplodedNode *generateSink(ProgramStateRef State = 0, 183 ExplodedNode *Pred = 0, 184 const ProgramPointTag *Tag = 0) { 185 return addTransitionImpl(State ? State : getState(), true, Pred, Tag); 186 } 187 188 /// \brief Emit the diagnostics report. 189 void emitReport(BugReport *R) { 190 Changed = true; 191 Eng.getBugReporter().emitReport(R); 192 } 193 194 /// \brief Get the declaration of the called function (path-sensitive). 195 const FunctionDecl *getCalleeDecl(const CallExpr *CE) const; 196 197 /// \brief Get the name of the called function (path-sensitive). 198 StringRef getCalleeName(const FunctionDecl *FunDecl) const; 199 200 /// \brief Get the identifier of the called function (path-sensitive). 201 const IdentifierInfo *getCalleeIdentifier(const CallExpr *CE) const { 202 const FunctionDecl *FunDecl = getCalleeDecl(CE); 203 if (FunDecl) 204 return FunDecl->getIdentifier(); 205 else 206 return 0; 207 } 208 209 /// \brief Get the name of the called function (path-sensitive). 210 StringRef getCalleeName(const CallExpr *CE) const { 211 const FunctionDecl *FunDecl = getCalleeDecl(CE); 212 return getCalleeName(FunDecl); 213 } 214 215 /// \brief Returns true if the callee is an externally-visible function in the 216 /// top-level namespace, such as \c malloc. 217 /// 218 /// If a name is provided, the function must additionally match the given 219 /// name. 220 /// 221 /// Note that this deliberately excludes C++ library functions in the \c std 222 /// namespace, but will include C library functions accessed through the 223 /// \c std namespace. This also does not check if the function is declared 224 /// as 'extern "C"', or if it uses C++ name mangling. 225 static bool isCLibraryFunction(const FunctionDecl *FD, 226 StringRef Name = StringRef()); 227 228 /// \brief Depending on wither the location corresponds to a macro, return 229 /// either the macro name or the token spelling. 230 /// 231 /// This could be useful when checkers' logic depends on whether a function 232 /// is called with a given macro argument. For example: 233 /// s = socket(AF_INET,..) 234 /// If AF_INET is a macro, the result should be treated as a source of taint. 235 /// 236 /// \sa clang::Lexer::getSpelling(), clang::Lexer::getImmediateMacroName(). 237 StringRef getMacroNameOrSpelling(SourceLocation &Loc); 238 239private: 240 ExplodedNode *addTransitionImpl(ProgramStateRef State, 241 bool MarkAsSink, 242 ExplodedNode *P = 0, 243 const ProgramPointTag *Tag = 0) { 244 if (!State || (State == Pred->getState() && !Tag && !MarkAsSink)) 245 return Pred; 246 247 Changed = true; 248 const ProgramPoint &LocalLoc = (Tag ? Location.withTag(Tag) : Location); 249 if (!P) 250 P = Pred; 251 252 ExplodedNode *node; 253 if (MarkAsSink) 254 node = NB.generateSink(LocalLoc, State, P); 255 else 256 node = NB.generateNode(LocalLoc, State, P); 257 return node; 258 } 259}; 260 261/// \brief A helper class which wraps a boolean value set to false by default. 262struct DefaultBool { 263 bool Val; 264 DefaultBool() : Val(false) {} 265 operator bool() const { return Val; } 266 DefaultBool &operator=(bool b) { Val = b; return *this; } 267}; 268 269} // end GR namespace 270 271} // end clang namespace 272 273#endif 274