1d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks//= CheckerDocumentation.cpp - Documentation checker ---------------*- C++ -*-// 2d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks// 3d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks// The LLVM Compiler Infrastructure 4d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks// 5d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks// This file is distributed under the University of Illinois Open Source 6d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks// License. See LICENSE.TXT for details. 7d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks// 8d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks//===----------------------------------------------------------------------===// 9d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks// 10d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks// This checker lists all the checker callbacks and provides documentation for 11d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks// checker writers. 12d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks// 13d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks//===----------------------------------------------------------------------===// 14d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks 15d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks#include "ClangSACheckers.h" 1655fc873017f10f6f566b182b70f6fc22aefa3464Chandler Carruth#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 17d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks#include "clang/StaticAnalyzer/Core/Checker.h" 18d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks#include "clang/StaticAnalyzer/Core/CheckerManager.h" 19d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" 20d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h" 21d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks 22d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaksusing namespace clang; 23d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaksusing namespace ento; 24d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks 25d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks// All checkers should be placed into anonymous namespace. 26d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks// We place the CheckerDocumentation inside ento namespace to make the 27d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks// it visible in doxygen. 2865bc6537509fcfb9e7e724e7d40546eea931e07fJordan Rosenamespace clang { 29d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaksnamespace ento { 30d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks 31d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks/// This checker documents the callback functions checkers can use to implement 32d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks/// the custom handling of the specific events during path exploration as well 33d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks/// as reporting bugs. Most of the callbacks are targeted at path-sensitive 34d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks/// checking. 35d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks/// 36d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks/// \sa CheckerContext 371f03a8a0334924719ff85c993d652480e93fda98Jordan Roseclass CheckerDocumentation : public Checker< check::PreStmt<ReturnStmt>, 381f03a8a0334924719ff85c993d652480e93fda98Jordan Rose check::PostStmt<DeclStmt>, 39d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks check::PreObjCMessage, 40d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks check::PostObjCMessage, 4196479da6ad9d921d875e7be29fe1bfa127be8069Jordan Rose check::PreCall, 4296479da6ad9d921d875e7be29fe1bfa127be8069Jordan Rose check::PostCall, 43d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks check::BranchCondition, 44d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks check::Location, 45d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks check::Bind, 46d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks check::DeadSymbols, 47344c77aac25e5d960aced3f45fbaa09853383f6dAnna Zaks check::EndFunction, 48d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks check::EndAnalysis, 49d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks check::EndOfTranslationUnit, 50d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks eval::Call, 51d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks eval::Assume, 52d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks check::LiveSymbols, 53d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks check::RegionChanges, 54bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks check::PointerEscape, 55123243cfd80f790a27edd1b829cd190a85f6c006Anna Zaks check::ConstPointerEscape, 56d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks check::Event<ImplicitNullDerefEvent>, 57d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks check::ASTDecl<FunctionDecl> > { 58d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zakspublic: 59d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks 60d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// \brief Pre-visit the Statement. 61d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// 62d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// The method will be called before the analyzer core processes the 63d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// statement. The notification is performed for every explored CFGElement, 64d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// which does not include the control flow statements such as IfStmt. The 65d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// callback can be specialized to be called with any subclass of Stmt. 66d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// 67d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// See checkBranchCondition() callback for performing custom processing of 68d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// the branching statements. 69d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// 701f03a8a0334924719ff85c993d652480e93fda98Jordan Rose /// check::PreStmt<ReturnStmt> 711f03a8a0334924719ff85c993d652480e93fda98Jordan Rose void checkPreStmt(const ReturnStmt *DS, CheckerContext &C) const {} 72d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks 73d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// \brief Post-visit the Statement. 74d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// 75d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// The method will be called after the analyzer core processes the 76d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// statement. The notification is performed for every explored CFGElement, 77d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// which does not include the control flow statements such as IfStmt. The 78d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// callback can be specialized to be called with any subclass of Stmt. 79d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// 801f03a8a0334924719ff85c993d652480e93fda98Jordan Rose /// check::PostStmt<DeclStmt> 811f03a8a0334924719ff85c993d652480e93fda98Jordan Rose void checkPostStmt(const DeclStmt *DS, CheckerContext &C) const; 82d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks 8396479da6ad9d921d875e7be29fe1bfa127be8069Jordan Rose /// \brief Pre-visit the Objective C message. 8496479da6ad9d921d875e7be29fe1bfa127be8069Jordan Rose /// 8596479da6ad9d921d875e7be29fe1bfa127be8069Jordan Rose /// This will be called before the analyzer core processes the method call. 8696479da6ad9d921d875e7be29fe1bfa127be8069Jordan Rose /// This is called for any action which produces an Objective-C message send, 878919e688dc610d1f632a4d43f7f1489f67255476Jordan Rose /// including explicit message syntax and property access. 8896479da6ad9d921d875e7be29fe1bfa127be8069Jordan Rose /// 8996479da6ad9d921d875e7be29fe1bfa127be8069Jordan Rose /// check::PreObjCMessage 90de507eaf3cb54d3cb234dc14499c10ab3373d15fJordan Rose void checkPreObjCMessage(const ObjCMethodCall &M, CheckerContext &C) const {} 91d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks 9296479da6ad9d921d875e7be29fe1bfa127be8069Jordan Rose /// \brief Post-visit the Objective C message. 9396479da6ad9d921d875e7be29fe1bfa127be8069Jordan Rose /// \sa checkPreObjCMessage() 9496479da6ad9d921d875e7be29fe1bfa127be8069Jordan Rose /// 9596479da6ad9d921d875e7be29fe1bfa127be8069Jordan Rose /// check::PostObjCMessage 96de507eaf3cb54d3cb234dc14499c10ab3373d15fJordan Rose void checkPostObjCMessage(const ObjCMethodCall &M, CheckerContext &C) const {} 97d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks 9896479da6ad9d921d875e7be29fe1bfa127be8069Jordan Rose /// \brief Pre-visit an abstract "call" event. 9996479da6ad9d921d875e7be29fe1bfa127be8069Jordan Rose /// 10096479da6ad9d921d875e7be29fe1bfa127be8069Jordan Rose /// This is used for checkers that want to check arguments or attributed 10196479da6ad9d921d875e7be29fe1bfa127be8069Jordan Rose /// behavior for functions and methods no matter how they are being invoked. 10296479da6ad9d921d875e7be29fe1bfa127be8069Jordan Rose /// 10396479da6ad9d921d875e7be29fe1bfa127be8069Jordan Rose /// Note that this includes ALL cross-body invocations, so if you want to 1041f03a8a0334924719ff85c993d652480e93fda98Jordan Rose /// limit your checks to, say, function calls, you should test for that at the 1051f03a8a0334924719ff85c993d652480e93fda98Jordan Rose /// beginning of your callback function. 10696479da6ad9d921d875e7be29fe1bfa127be8069Jordan Rose /// 10796479da6ad9d921d875e7be29fe1bfa127be8069Jordan Rose /// check::PreCall 10896479da6ad9d921d875e7be29fe1bfa127be8069Jordan Rose void checkPreCall(const CallEvent &Call, CheckerContext &C) const {} 10996479da6ad9d921d875e7be29fe1bfa127be8069Jordan Rose 11096479da6ad9d921d875e7be29fe1bfa127be8069Jordan Rose /// \brief Post-visit an abstract "call" event. 11196479da6ad9d921d875e7be29fe1bfa127be8069Jordan Rose /// \sa checkPreObjCMessage() 11296479da6ad9d921d875e7be29fe1bfa127be8069Jordan Rose /// 11396479da6ad9d921d875e7be29fe1bfa127be8069Jordan Rose /// check::PostCall 11496479da6ad9d921d875e7be29fe1bfa127be8069Jordan Rose void checkPostCall(const CallEvent &Call, CheckerContext &C) const {} 11596479da6ad9d921d875e7be29fe1bfa127be8069Jordan Rose 116d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// \brief Pre-visit of the condition statement of a branch (such as IfStmt). 117d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks void checkBranchCondition(const Stmt *Condition, CheckerContext &Ctx) const {} 118d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks 119d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// \brief Called on a load from and a store to a location. 120d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// 121d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// The method will be called each time a location (pointer) value is 122d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// accessed. 123d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// \param Loc The value of the location (pointer). 124d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// \param IsLoad The flag specifying if the location is a store or a load. 125d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// \param S The load is performed while processing the statement. 126d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// 127d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// check::Location 128d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks void checkLocation(SVal Loc, bool IsLoad, const Stmt *S, 12981c16fc757fe7b68cbd035765e3be92281625663James Dennett CheckerContext &) const {} 130d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks 131d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// \brief Called on binding of a value to a location. 132d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// 133d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// \param Loc The value of the location (pointer). 134d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// \param Val The value which will be stored at the location Loc. 135d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// \param S The bind is performed while processing the statement S. 136d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// 137d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// check::Bind 13881c16fc757fe7b68cbd035765e3be92281625663James Dennett void checkBind(SVal Loc, SVal Val, const Stmt *S, CheckerContext &) const {} 139d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks 140d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks 141d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// \brief Called whenever a symbol becomes dead. 142d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// 143d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// This callback should be used by the checkers to aggressively clean 144d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// up/reduce the checker state, which is important for reducing the overall 145d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// memory usage. Specifically, if a checker keeps symbol specific information 146d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// in the sate, it can and should be dropped after the symbol becomes dead. 147d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// In addition, reporting a bug as soon as the checker becomes dead leads to 148d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// more precise diagnostics. (For example, one should report that a malloced 149d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// variable is not freed right after it goes out of scope.) 150d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// 151d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// \param SR The SymbolReaper object can be queried to determine which 152d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// symbols are dead. 153d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// 154d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// check::DeadSymbols 155d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks void checkDeadSymbols(SymbolReaper &SR, CheckerContext &C) const {} 156d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks 157344c77aac25e5d960aced3f45fbaa09853383f6dAnna Zaks /// \brief Called when the analyzer core reaches the end of a 15865bc6537509fcfb9e7e724e7d40546eea931e07fJordan Rose /// function being analyzed. 159d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// 160344c77aac25e5d960aced3f45fbaa09853383f6dAnna Zaks /// check::EndFunction 161344c77aac25e5d960aced3f45fbaa09853383f6dAnna Zaks void checkEndFunction(CheckerContext &Ctx) const {} 162d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks 163d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// \brief Called after all the paths in the ExplodedGraph reach end of path 164d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// - the symbolic execution graph is fully explored. 165d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// 166d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// This callback should be used in cases when a checker needs to have a 167d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// global view of the information generated on all paths. For example, to 168d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// compare execution summary/result several paths. 169d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// See IdempotentOperationChecker for a usage example. 170d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// 171d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// check::EndAnalysis 172d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks void checkEndAnalysis(ExplodedGraph &G, 173d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks BugReporter &BR, 174d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks ExprEngine &Eng) const {} 175d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks 176d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// \brief Called after analysis of a TranslationUnit is complete. 177d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// 178d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// check::EndOfTranslationUnit 179e8018f24f0f0e1cb1490c37b158da5d5c456e577Anton Yartsev void checkEndOfTranslationUnit(const TranslationUnitDecl *TU, 180e8018f24f0f0e1cb1490c37b158da5d5c456e577Anton Yartsev AnalysisManager &Mgr, 181e8018f24f0f0e1cb1490c37b158da5d5c456e577Anton Yartsev BugReporter &BR) const {} 182d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks 183d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks 184d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// \brief Evaluates function call. 185d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// 186d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// The analysis core threats all function calls in the same way. However, some 187d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// functions have special meaning, which should be reflected in the program 188d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// state. This callback allows a checker to provide domain specific knowledge 189d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// about the particular functions it knows about. 190d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// 191d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// \returns true if the call has been successfully evaluated 192d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// and false otherwise. Note, that only one checker can evaluate a call. If 193872db39510372c4acd8851a3b956e1a135cfcd41Duncan Sands /// more than one checker claims that they can evaluate the same call the 194d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// first one wins. 195d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// 196d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// eval::Call 197d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks bool evalCall(const CallExpr *CE, CheckerContext &C) const { return true; } 198d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks 199d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// \brief Handles assumptions on symbolic values. 200d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// 201d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// This method is called when a symbolic expression is assumed to be true or 202d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// false. For example, the assumptions are performed when evaluating a 203d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// condition at a branch. The callback allows checkers track the assumptions 204d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// performed on the symbols of interest and change the state accordingly. 205d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// 206d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// eval::Assume 2078bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef evalAssume(ProgramStateRef State, 208d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks SVal Cond, 209d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks bool Assumption) const { return State; } 210d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks 211d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// Allows modifying SymbolReaper object. For example, checkers can explicitly 212d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// register symbols of interest as live. These symbols will not be marked 213d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// dead and removed. 214d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// 215d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// check::LiveSymbols 2168bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek void checkLiveSymbols(ProgramStateRef State, SymbolReaper &SR) const {} 217d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks 21865bc6537509fcfb9e7e724e7d40546eea931e07fJordan Rose /// \brief Called to determine if the checker currently needs to know if when 21965bc6537509fcfb9e7e724e7d40546eea931e07fJordan Rose /// contents of any regions change. 22065bc6537509fcfb9e7e724e7d40546eea931e07fJordan Rose /// 22165bc6537509fcfb9e7e724e7d40546eea931e07fJordan Rose /// Since it is not necessarily cheap to compute which regions are being 22265bc6537509fcfb9e7e724e7d40546eea931e07fJordan Rose /// changed, this allows the analyzer core to skip the more expensive 22365bc6537509fcfb9e7e724e7d40546eea931e07fJordan Rose /// #checkRegionChanges when no checkers are tracking any state. 2248bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek bool wantsRegionChangeUpdate(ProgramStateRef St) const { return true; } 22566c40400e7d6272b0cd675ada18dd62c1f0362c7Anna Zaks 22665bc6537509fcfb9e7e724e7d40546eea931e07fJordan Rose /// \brief Called when the contents of one or more regions change. 22765bc6537509fcfb9e7e724e7d40546eea931e07fJordan Rose /// 22865bc6537509fcfb9e7e724e7d40546eea931e07fJordan Rose /// This can occur in many different ways: an explicit bind, a blanket 22965bc6537509fcfb9e7e724e7d40546eea931e07fJordan Rose /// invalidation of the region contents, or by passing a region to a function 23065bc6537509fcfb9e7e724e7d40546eea931e07fJordan Rose /// call whose behavior the analyzer cannot model perfectly. 23181c16fc757fe7b68cbd035765e3be92281625663James Dennett /// 23281c16fc757fe7b68cbd035765e3be92281625663James Dennett /// \param State The current program state. 23381c16fc757fe7b68cbd035765e3be92281625663James Dennett /// \param Invalidated A set of all symbols potentially touched by the change. 23466c40400e7d6272b0cd675ada18dd62c1f0362c7Anna Zaks /// \param ExplicitRegions The regions explicitly requested for invalidation. 23565bc6537509fcfb9e7e724e7d40546eea931e07fJordan Rose /// For a function call, this would be the arguments. For a bind, this 23665bc6537509fcfb9e7e724e7d40546eea931e07fJordan Rose /// would be the region being bound to. 23765bc6537509fcfb9e7e724e7d40546eea931e07fJordan Rose /// \param Regions The transitive closure of regions accessible from, 23865bc6537509fcfb9e7e724e7d40546eea931e07fJordan Rose /// \p ExplicitRegions, i.e. all regions that may have been touched 23965bc6537509fcfb9e7e724e7d40546eea931e07fJordan Rose /// by this change. For a simple bind, this list will be the same as 24065bc6537509fcfb9e7e724e7d40546eea931e07fJordan Rose /// \p ExplicitRegions, since a bind does not affect the contents of 24165bc6537509fcfb9e7e724e7d40546eea931e07fJordan Rose /// anything accessible through the base region. 24265bc6537509fcfb9e7e724e7d40546eea931e07fJordan Rose /// \param Call The opaque call triggering this invalidation. Will be 0 if the 24365bc6537509fcfb9e7e724e7d40546eea931e07fJordan Rose /// change was not triggered by a call. 24465bc6537509fcfb9e7e724e7d40546eea931e07fJordan Rose /// 24565bc6537509fcfb9e7e724e7d40546eea931e07fJordan Rose /// Note that this callback will not be invoked unless 24665bc6537509fcfb9e7e724e7d40546eea931e07fJordan Rose /// #wantsRegionChangeUpdate returns \c true. 24781c16fc757fe7b68cbd035765e3be92281625663James Dennett /// 24881c16fc757fe7b68cbd035765e3be92281625663James Dennett /// check::RegionChanges 2498bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef 2508bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek checkRegionChanges(ProgramStateRef State, 251bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks const InvalidatedSymbols *Invalidated, 252d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks ArrayRef<const MemRegion *> ExplicitRegions, 25366c40400e7d6272b0cd675ada18dd62c1f0362c7Anna Zaks ArrayRef<const MemRegion *> Regions, 254740d490593e0de8732a697c9f77b90ddd463863bJordan Rose const CallEvent *Call) const { 255d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks return State; 256d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks } 257d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks 258bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks /// \brief Called when pointers escape. 259bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks /// 260bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks /// This notifies the checkers about pointer escape, which occurs whenever 2611655bcd052a67a3050fc55df8ecce57342352e68Anna Zaks /// the analyzer cannot track the symbol any more. For example, as a 262bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks /// result of assigning a pointer into a global or when it's passed to a 263bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks /// function call the analyzer cannot model. 264bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks /// 265bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks /// \param State The state at the point of escape. 266bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks /// \param Escaped The list of escaped symbols. 267bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks /// \param Call The corresponding CallEvent, if the symbols escape as 268bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks /// parameters to the given call. 269233e26acc0ff2a1098f4c813f69286fce840a422Anna Zaks /// \param Kind How the symbols have escaped. 270bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks /// \returns Checkers can modify the state by returning a new state. 271bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks ProgramStateRef checkPointerEscape(ProgramStateRef State, 272bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks const InvalidatedSymbols &Escaped, 273233e26acc0ff2a1098f4c813f69286fce840a422Anna Zaks const CallEvent *Call, 274233e26acc0ff2a1098f4c813f69286fce840a422Anna Zaks PointerEscapeKind Kind) const { 275bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks return State; 276bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks } 277bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks 278123243cfd80f790a27edd1b829cd190a85f6c006Anna Zaks /// \brief Called when const pointers escape. 279123243cfd80f790a27edd1b829cd190a85f6c006Anna Zaks /// 280123243cfd80f790a27edd1b829cd190a85f6c006Anna Zaks /// Note: in most cases checkPointerEscape callback is sufficient. 281123243cfd80f790a27edd1b829cd190a85f6c006Anna Zaks /// \sa checkPointerEscape 282123243cfd80f790a27edd1b829cd190a85f6c006Anna Zaks ProgramStateRef checkConstPointerEscape(ProgramStateRef State, 283123243cfd80f790a27edd1b829cd190a85f6c006Anna Zaks const InvalidatedSymbols &Escaped, 284123243cfd80f790a27edd1b829cd190a85f6c006Anna Zaks const CallEvent *Call, 285123243cfd80f790a27edd1b829cd190a85f6c006Anna Zaks PointerEscapeKind Kind) const { 286123243cfd80f790a27edd1b829cd190a85f6c006Anna Zaks return State; 287123243cfd80f790a27edd1b829cd190a85f6c006Anna Zaks } 288123243cfd80f790a27edd1b829cd190a85f6c006Anna Zaks 289d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// check::Event<ImplicitNullDerefEvent> 290d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks void checkEvent(ImplicitNullDerefEvent Event) const {} 291d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks 292d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// \brief Check every declaration in the AST. 293d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// 294d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// An AST traversal callback, which should only be used when the checker is 295d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// not path sensitive. It will be called for every Declaration in the AST and 296d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// can be specialized to only be called on subclasses of Decl, for example, 297d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// FunctionDecl. 298d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// 299d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks /// check::ASTDecl<FunctionDecl> 300d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks void checkASTDecl(const FunctionDecl *D, 301d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks AnalysisManager &Mgr, 302d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks BugReporter &BR) const {} 303d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks 304d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks}; 305d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks 3061f03a8a0334924719ff85c993d652480e93fda98Jordan Rosevoid CheckerDocumentation::checkPostStmt(const DeclStmt *DS, 307d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks CheckerContext &C) const { 308d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks return; 309d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks} 310d699ade396154238d2fa89bb09fdcfb79e5587d2Anna Zaks 31165bc6537509fcfb9e7e724e7d40546eea931e07fJordan Rose} // end namespace ento 31265bc6537509fcfb9e7e724e7d40546eea931e07fJordan Rose} // end namespace clang 313