CheckerContext.h revision d1ad5e5d6c895f809ada5b420060b2ec0b48567b 
1//== CheckerContext.h - Context info for path-sensitive checkers--*- C++ -*--=//
2//
3//                     The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10//  This file defines CheckerContext that provides contextual info for
11// path-sensitive checkers.
12//
13//===----------------------------------------------------------------------===//
14
15#ifndef LLVM_CLANG_SA_CORE_PATHSENSITIVE_CHECKERCONTEXT
16#define LLVM_CLANG_SA_CORE_PATHSENSITIVE_CHECKERCONTEXT
17
18#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
19#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
20
21namespace clang {
22namespace ento {
23
24  /// Declares an immutable map of type \p NameTy, suitable for placement into
25  /// the ProgramState.
26  ///
27  /// The macro should not be used inside namespaces, or for traits that must
28  /// be accessible from more than one translation unit.
29  #define REGISTER_MAP_WITH_PROGRAMSTATE(Name, Key, Value) \
30    REGISTER_TRAIT_WITH_PROGRAMSTATE(Name, \
31                                     CLANG_ENTO_PROGRAMSTATE_MAP(Key, Value))
32
33  /// Declares an immutable list of type \p NameTy, suitable for placement into
34  /// the ProgramState.
35  ///
36  /// The macro should not be used inside namespaces, or for traits that must
37  /// be accessible from more than one translation unit.
38  #define REGISTER_SET_WITH_PROGRAMSTATE(Name, Elem) \
39    REGISTER_TRAIT_WITH_PROGRAMSTATE(Name, llvm::ImmutableSet<Elem>)
40
41  /// Declares an immutable list of type \p NameTy, suitable for placement into
42  /// the ProgramState.
43  ///
44  /// The macro should not be used inside namespaces, or for traits that must
45  /// be accessible from more than one translation unit.
46  #define REGISTER_LIST_WITH_PROGRAMSTATE(Name, Elem) \
47    REGISTER_TRAIT_WITH_PROGRAMSTATE(Name, llvm::ImmutableList<Elem>)
48
49
50class CheckerContext {
51  ExprEngine &Eng;
52  /// The current exploded(symbolic execution) graph node.
53  ExplodedNode *Pred;
54  /// The flag is true if the (state of the execution) has been modified
55  /// by the checker using this context. For example, a new transition has been
56  /// added or a bug report issued.
57  bool Changed;
58  /// The tagged location, which is used to generate all new nodes.
59  const ProgramPoint Location;
60  NodeBuilder &NB;
61
62public:
63  /// If we are post visiting a call, this flag will be set if the
64  /// call was inlined.  In all other cases it will be false.
65  const bool wasInlined;
66
67  CheckerContext(NodeBuilder &builder,
68                 ExprEngine &eng,
69                 ExplodedNode *pred,
70                 const ProgramPoint &loc,
71                 bool wasInlined = false)
72    : Eng(eng),
73      Pred(pred),
74      Changed(false),
75      Location(loc),
76      NB(builder),
77      wasInlined(wasInlined) {
78    assert(Pred->getState() &&
79           "We should not call the checkers on an empty state.");
80  }
81
82  AnalysisManager &getAnalysisManager() {
83    return Eng.getAnalysisManager();
84  }
85
86  ConstraintManager &getConstraintManager() {
87    return Eng.getConstraintManager();
88  }
89
90  StoreManager &getStoreManager() {
91    return Eng.getStoreManager();
92  }
93
94  const AnalyzerOptions::ConfigTable &getConfig() const {
95    return Eng.getAnalysisManager().options.Config;
96  }
97
98  /// \brief Returns the previous node in the exploded graph, which includes
99  /// the state of the program before the checker ran. Note, checkers should
100  /// not retain the node in their state since the nodes might get invalidated.
101  ExplodedNode *getPredecessor() { return Pred; }
102  ProgramStateRef getState() const { return Pred->getState(); }
103
104  /// \brief Check if the checker changed the state of the execution; ex: added
105  /// a new transition or a bug report.
106  bool isDifferent() { return Changed; }
107
108  /// \brief Returns the number of times the current block has been visited
109  /// along the analyzed path.
110  unsigned blockCount() const {
111    return NB.getContext().blockCount();
112  }
113
114  ASTContext &getASTContext() {
115    return Eng.getContext();
116  }
117
118  const LangOptions &getLangOpts() const {
119    return Eng.getContext().getLangOpts();
120  }
121
122  const LocationContext *getLocationContext() const {
123    return Pred->getLocationContext();
124  }
125
126  const StackFrameContext *getStackFrame() const {
127    return Pred->getStackFrame();
128  }
129
130  /// Return true if the current LocationContext has no caller context.
131  bool inTopFrame() const { return getLocationContext()->inTopFrame();  }
132
133  BugReporter &getBugReporter() {
134    return Eng.getBugReporter();
135  }
136
137  SourceManager &getSourceManager() {
138    return getBugReporter().getSourceManager();
139  }
140
141  SValBuilder &getSValBuilder() {
142    return Eng.getSValBuilder();
143  }
144
145  SymbolManager &getSymbolManager() {
146    return getSValBuilder().getSymbolManager();
147  }
148
149  bool isObjCGCEnabled() const {
150    return Eng.isObjCGCEnabled();
151  }
152
153  ProgramStateManager &getStateManager() {
154    return Eng.getStateManager();
155  }
156
157  AnalysisDeclContext *getCurrentAnalysisDeclContext() const {
158    return Pred->getLocationContext()->getAnalysisDeclContext();
159  }
160
161  /// \brief If the given node corresponds to a PostStore program point, retrieve
162  /// the location region as it was uttered in the code.
163  ///
164  /// This utility can be useful for generating extensive diagnostics, for
165  /// example, for finding variables that the given symbol was assigned to.
166  static const MemRegion *getLocationRegionIfPostStore(const ExplodedNode *N) {
167    ProgramPoint L = N->getLocation();
168    if (const PostStore *PSL = dyn_cast<PostStore>(&L))
169      return reinterpret_cast<const MemRegion*>(PSL->getLocationValue());
170    return 0;
171  }
172
173  /// \brief Get the value of arbitrary expressions at this point in the path.
174  SVal getSVal(const Stmt *S) const {
175    return getState()->getSVal(S, getLocationContext());
176  }
177
178  /// \brief Generates a new transition in the program state graph
179  /// (ExplodedGraph). Uses the default CheckerContext predecessor node.
180  ///
181  /// @param State The state of the generated node. If not specified, the state
182  ///        will not be changed, but the new node will have the checker's tag.
183  /// @param Tag The tag is used to uniquely identify the creation site. If no
184  ///        tag is specified, a default tag, unique to the given checker,
185  ///        will be used. Tags are used to prevent states generated at
186  ///        different sites from caching out.
187  ExplodedNode *addTransition(ProgramStateRef State = 0,
188                              const ProgramPointTag *Tag = 0) {
189    return addTransitionImpl(State ? State : getState(), false, 0, Tag);
190  }
191
192  /// \brief Generates a new transition with the given predecessor.
193  /// Allows checkers to generate a chain of nodes.
194  ///
195  /// @param State The state of the generated node.
196  /// @param Pred The transition will be generated from the specified Pred node
197  ///             to the newly generated node.
198  /// @param Tag The tag to uniquely identify the creation site.
199  ExplodedNode *addTransition(ProgramStateRef State,
200                              ExplodedNode *Pred,
201                              const ProgramPointTag *Tag = 0) {
202    return addTransitionImpl(State, false, Pred, Tag);
203  }
204
205  /// \brief Generate a sink node. Generating a sink stops exploration of the
206  /// given path.
207  ExplodedNode *generateSink(ProgramStateRef State = 0,
208                             ExplodedNode *Pred = 0,
209                             const ProgramPointTag *Tag = 0) {
210    return addTransitionImpl(State ? State : getState(), true, Pred, Tag);
211  }
212
213  /// \brief Emit the diagnostics report.
214  void emitReport(BugReport *R) {
215    Changed = true;
216    Eng.getBugReporter().emitReport(R);
217  }
218
219  /// \brief Get the declaration of the called function (path-sensitive).
220  const FunctionDecl *getCalleeDecl(const CallExpr *CE) const;
221
222  /// \brief Get the name of the called function (path-sensitive).
223  StringRef getCalleeName(const FunctionDecl *FunDecl) const;
224
225  /// \brief Get the identifier of the called function (path-sensitive).
226  const IdentifierInfo *getCalleeIdentifier(const CallExpr *CE) const {
227    const FunctionDecl *FunDecl = getCalleeDecl(CE);
228    if (FunDecl)
229      return FunDecl->getIdentifier();
230    else
231      return 0;
232  }
233
234  /// \brief Get the name of the called function (path-sensitive).
235  StringRef getCalleeName(const CallExpr *CE) const {
236    const FunctionDecl *FunDecl = getCalleeDecl(CE);
237    return getCalleeName(FunDecl);
238  }
239
240  /// \brief Returns true if the callee is an externally-visible function in the
241  /// top-level namespace, such as \c malloc.
242  ///
243  /// If a name is provided, the function must additionally match the given
244  /// name.
245  ///
246  /// Note that this deliberately excludes C++ library functions in the \c std
247  /// namespace, but will include C library functions accessed through the
248  /// \c std namespace. This also does not check if the function is declared
249  /// as 'extern "C"', or if it uses C++ name mangling.
250  static bool isCLibraryFunction(const FunctionDecl *FD,
251                                 StringRef Name = StringRef());
252
253  /// \brief Depending on wither the location corresponds to a macro, return
254  /// either the macro name or the token spelling.
255  ///
256  /// This could be useful when checkers' logic depends on whether a function
257  /// is called with a given macro argument. For example:
258  ///   s = socket(AF_INET,..)
259  /// If AF_INET is a macro, the result should be treated as a source of taint.
260  ///
261  /// \sa clang::Lexer::getSpelling(), clang::Lexer::getImmediateMacroName().
262  StringRef getMacroNameOrSpelling(SourceLocation &Loc);
263
264private:
265  ExplodedNode *addTransitionImpl(ProgramStateRef State,
266                                 bool MarkAsSink,
267                                 ExplodedNode *P = 0,
268                                 const ProgramPointTag *Tag = 0) {
269    if (!State || (State == Pred->getState() && !Tag && !MarkAsSink))
270      return Pred;
271
272    Changed = true;
273    const ProgramPoint &LocalLoc = (Tag ? Location.withTag(Tag) : Location);
274    if (!P)
275      P = Pred;
276
277    ExplodedNode *node;
278    if (MarkAsSink)
279      node = NB.generateSink(LocalLoc, State, P);
280    else
281      node = NB.generateNode(LocalLoc, State, P);
282    return node;
283  }
284};
285
286/// \brief A helper class which wraps a boolean value set to false by default.
287struct DefaultBool {
288  bool Val;
289  DefaultBool() : Val(false) {}
290  operator bool() const { return Val; }
291  DefaultBool &operator=(bool b) { Val = b; return *this; }
292};
293
294} // end GR namespace
295
296} // end clang namespace
297
298#endif
299