BuiltinFunctionChecker.cpp revision 8bef8238181a30e52dea380789a7e2d760eac532 
1//=== BuiltinFunctionChecker.cpp --------------------------------*- C++ -*-===//
2//
3//                     The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10// This checker evaluates clang builtin functions.
11//
12//===----------------------------------------------------------------------===//
13
14#include "ClangSACheckers.h"
15#include "clang/StaticAnalyzer/Core/Checker.h"
16#include "clang/StaticAnalyzer/Core/CheckerManager.h"
17#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
18#include "clang/Basic/Builtins.h"
19
20using namespace clang;
21using namespace ento;
22
23namespace {
24
25class BuiltinFunctionChecker : public Checker<eval::Call> {
26public:
27  bool evalCall(const CallExpr *CE, CheckerContext &C) const;
28};
29
30}
31
32bool BuiltinFunctionChecker::evalCall(const CallExpr *CE,
33                                      CheckerContext &C) const {
34  ProgramStateRef state = C.getState();
35  const FunctionDecl *FD = C.getCalleeDecl(CE);
36  const LocationContext *LCtx = C.getLocationContext();
37  if (!FD)
38    return false;
39
40  unsigned id = FD->getBuiltinID();
41
42  if (!id)
43    return false;
44
45  switch (id) {
46  case Builtin::BI__builtin_expect: {
47    // For __builtin_expect, just return the value of the subexpression.
48    assert (CE->arg_begin() != CE->arg_end());
49    SVal X = state->getSVal(*(CE->arg_begin()), LCtx);
50    C.addTransition(state->BindExpr(CE, LCtx, X));
51    return true;
52  }
53
54  case Builtin::BI__builtin_alloca: {
55    // FIXME: Refactor into StoreManager itself?
56    MemRegionManager& RM = C.getStoreManager().getRegionManager();
57    const AllocaRegion* R =
58      RM.getAllocaRegion(CE, C.getCurrentBlockCount(), C.getLocationContext());
59
60    // Set the extent of the region in bytes. This enables us to use the
61    // SVal of the argument directly. If we save the extent in bits, we
62    // cannot represent values like symbol*8.
63    DefinedOrUnknownSVal Size =
64      cast<DefinedOrUnknownSVal>(state->getSVal(*(CE->arg_begin()), LCtx));
65
66    SValBuilder& svalBuilder = C.getSValBuilder();
67    DefinedOrUnknownSVal Extent = R->getExtent(svalBuilder);
68    DefinedOrUnknownSVal extentMatchesSizeArg =
69      svalBuilder.evalEQ(state, Extent, Size);
70    state = state->assume(extentMatchesSizeArg, true);
71
72    C.addTransition(state->BindExpr(CE, LCtx, loc::MemRegionVal(R)));
73    return true;
74  }
75  }
76
77  return false;
78}
79
80void ento::registerBuiltinFunctionChecker(CheckerManager &mgr) {
81  mgr.registerChecker<BuiltinFunctionChecker>();
82}
83