BuiltinFunctionChecker.cpp revision 55fc873017f10f6f566b182b70f6fc22aefa3464 
1//=== BuiltinFunctionChecker.cpp --------------------------------*- C++ -*-===//
2//
3//                     The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10// This checker evaluates clang builtin functions.
11//
12//===----------------------------------------------------------------------===//
13
14#include "ClangSACheckers.h"
15#include "clang/Basic/Builtins.h"
16#include "clang/StaticAnalyzer/Core/Checker.h"
17#include "clang/StaticAnalyzer/Core/CheckerManager.h"
18#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
19
20using namespace clang;
21using namespace ento;
22
23namespace {
24
25class BuiltinFunctionChecker : public Checker<eval::Call> {
26public:
27  bool evalCall(const CallExpr *CE, CheckerContext &C) const;
28};
29
30}
31
32bool BuiltinFunctionChecker::evalCall(const CallExpr *CE,
33                                      CheckerContext &C) const {
34  ProgramStateRef state = C.getState();
35  const FunctionDecl *FD = C.getCalleeDecl(CE);
36  const LocationContext *LCtx = C.getLocationContext();
37  if (!FD)
38    return false;
39
40  unsigned id = FD->getBuiltinID();
41
42  if (!id)
43    return false;
44
45  switch (id) {
46  case Builtin::BI__builtin_expect: {
47    // For __builtin_expect, just return the value of the subexpression.
48    assert (CE->arg_begin() != CE->arg_end());
49    SVal X = state->getSVal(*(CE->arg_begin()), LCtx);
50    C.addTransition(state->BindExpr(CE, LCtx, X));
51    return true;
52  }
53
54  case Builtin::BI__builtin_alloca: {
55    // FIXME: Refactor into StoreManager itself?
56    MemRegionManager& RM = C.getStoreManager().getRegionManager();
57    const AllocaRegion* R =
58      RM.getAllocaRegion(CE, C.blockCount(), C.getLocationContext());
59
60    // Set the extent of the region in bytes. This enables us to use the
61    // SVal of the argument directly. If we save the extent in bits, we
62    // cannot represent values like symbol*8.
63    DefinedOrUnknownSVal Size =
64      cast<DefinedOrUnknownSVal>(state->getSVal(*(CE->arg_begin()), LCtx));
65
66    SValBuilder& svalBuilder = C.getSValBuilder();
67    DefinedOrUnknownSVal Extent = R->getExtent(svalBuilder);
68    DefinedOrUnknownSVal extentMatchesSizeArg =
69      svalBuilder.evalEQ(state, Extent, Size);
70    state = state->assume(extentMatchesSizeArg, true);
71    assert(state && "The region should not have any previous constraints");
72
73    C.addTransition(state->BindExpr(CE, LCtx, loc::MemRegionVal(R)));
74    return true;
75  }
76  }
77
78  return false;
79}
80
81void ento::registerBuiltinFunctionChecker(CheckerManager &mgr) {
82  mgr.registerChecker<BuiltinFunctionChecker>();
83}
84