1//== CheckerContext.h - Context info for path-sensitive checkers--*- C++ -*--=//
2//
3//                     The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10//  This file defines CheckerContext that provides contextual info for
11// path-sensitive checkers.
12//
13//===----------------------------------------------------------------------===//
14
15#ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CHECKERCONTEXT_H
16#define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CHECKERCONTEXT_H
17
18#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
19#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
20
21namespace clang {
22namespace ento {
23
24  /// Declares an immutable map of type \p NameTy, suitable for placement into
25  /// the ProgramState. This is implementing using llvm::ImmutableMap.
26  ///
27  /// \code
28  /// State = State->set<Name>(K, V);
29  /// const Value *V = State->get<Name>(K); // Returns NULL if not in the map.
30  /// State = State->remove<Name>(K);
31  /// NameTy Map = State->get<Name>();
32  /// \endcode
33  ///
34  /// The macro should not be used inside namespaces, or for traits that must
35  /// be accessible from more than one translation unit.
36  #define REGISTER_MAP_WITH_PROGRAMSTATE(Name, Key, Value) \
37    REGISTER_TRAIT_WITH_PROGRAMSTATE(Name, \
38                                     CLANG_ENTO_PROGRAMSTATE_MAP(Key, Value))
39
40  /// Declares an immutable set of type \p NameTy, suitable for placement into
41  /// the ProgramState. This is implementing using llvm::ImmutableSet.
42  ///
43  /// \code
44  /// State = State->add<Name>(E);
45  /// State = State->remove<Name>(E);
46  /// bool Present = State->contains<Name>(E);
47  /// NameTy Set = State->get<Name>();
48  /// \endcode
49  ///
50  /// The macro should not be used inside namespaces, or for traits that must
51  /// be accessible from more than one translation unit.
52  #define REGISTER_SET_WITH_PROGRAMSTATE(Name, Elem) \
53    REGISTER_TRAIT_WITH_PROGRAMSTATE(Name, llvm::ImmutableSet<Elem>)
54
55  /// Declares an immutable list of type \p NameTy, suitable for placement into
56  /// the ProgramState. This is implementing using llvm::ImmutableList.
57  ///
58  /// \code
59  /// State = State->add<Name>(E); // Adds to the /end/ of the list.
60  /// bool Present = State->contains<Name>(E);
61  /// NameTy List = State->get<Name>();
62  /// \endcode
63  ///
64  /// The macro should not be used inside namespaces, or for traits that must
65  /// be accessible from more than one translation unit.
66  #define REGISTER_LIST_WITH_PROGRAMSTATE(Name, Elem) \
67    REGISTER_TRAIT_WITH_PROGRAMSTATE(Name, llvm::ImmutableList<Elem>)
68
69
70class CheckerContext {
71  ExprEngine &Eng;
72  /// The current exploded(symbolic execution) graph node.
73  ExplodedNode *Pred;
74  /// The flag is true if the (state of the execution) has been modified
75  /// by the checker using this context. For example, a new transition has been
76  /// added or a bug report issued.
77  bool Changed;
78  /// The tagged location, which is used to generate all new nodes.
79  const ProgramPoint Location;
80  NodeBuilder &NB;
81
82public:
83  /// If we are post visiting a call, this flag will be set if the
84  /// call was inlined.  In all other cases it will be false.
85  const bool wasInlined;
86
87  CheckerContext(NodeBuilder &builder,
88                 ExprEngine &eng,
89                 ExplodedNode *pred,
90                 const ProgramPoint &loc,
91                 bool wasInlined = false)
92    : Eng(eng),
93      Pred(pred),
94      Changed(false),
95      Location(loc),
96      NB(builder),
97      wasInlined(wasInlined) {
98    assert(Pred->getState() &&
99           "We should not call the checkers on an empty state.");
100  }
101
102  AnalysisManager &getAnalysisManager() {
103    return Eng.getAnalysisManager();
104  }
105
106  ConstraintManager &getConstraintManager() {
107    return Eng.getConstraintManager();
108  }
109
110  StoreManager &getStoreManager() {
111    return Eng.getStoreManager();
112  }
113
114  /// \brief Returns the previous node in the exploded graph, which includes
115  /// the state of the program before the checker ran. Note, checkers should
116  /// not retain the node in their state since the nodes might get invalidated.
117  ExplodedNode *getPredecessor() { return Pred; }
118  const ProgramStateRef &getState() const { return Pred->getState(); }
119
120  /// \brief Check if the checker changed the state of the execution; ex: added
121  /// a new transition or a bug report.
122  bool isDifferent() { return Changed; }
123
124  /// \brief Returns the number of times the current block has been visited
125  /// along the analyzed path.
126  unsigned blockCount() const {
127    return NB.getContext().blockCount();
128  }
129
130  ASTContext &getASTContext() {
131    return Eng.getContext();
132  }
133
134  const LangOptions &getLangOpts() const {
135    return Eng.getContext().getLangOpts();
136  }
137
138  const LocationContext *getLocationContext() const {
139    return Pred->getLocationContext();
140  }
141
142  const StackFrameContext *getStackFrame() const {
143    return Pred->getStackFrame();
144  }
145
146  /// Return true if the current LocationContext has no caller context.
147  bool inTopFrame() const { return getLocationContext()->inTopFrame();  }
148
149  BugReporter &getBugReporter() {
150    return Eng.getBugReporter();
151  }
152
153  SourceManager &getSourceManager() {
154    return getBugReporter().getSourceManager();
155  }
156
157  SValBuilder &getSValBuilder() {
158    return Eng.getSValBuilder();
159  }
160
161  SymbolManager &getSymbolManager() {
162    return getSValBuilder().getSymbolManager();
163  }
164
165  bool isObjCGCEnabled() const {
166    return Eng.isObjCGCEnabled();
167  }
168
169  ProgramStateManager &getStateManager() {
170    return Eng.getStateManager();
171  }
172
173  AnalysisDeclContext *getCurrentAnalysisDeclContext() const {
174    return Pred->getLocationContext()->getAnalysisDeclContext();
175  }
176
177  /// \brief Get the blockID.
178  unsigned getBlockID() const {
179    return NB.getContext().getBlock()->getBlockID();
180  }
181
182  /// \brief If the given node corresponds to a PostStore program point,
183  /// retrieve the location region as it was uttered in the code.
184  ///
185  /// This utility can be useful for generating extensive diagnostics, for
186  /// example, for finding variables that the given symbol was assigned to.
187  static const MemRegion *getLocationRegionIfPostStore(const ExplodedNode *N) {
188    ProgramPoint L = N->getLocation();
189    if (Optional<PostStore> PSL = L.getAs<PostStore>())
190      return reinterpret_cast<const MemRegion*>(PSL->getLocationValue());
191    return nullptr;
192  }
193
194  /// \brief Get the value of arbitrary expressions at this point in the path.
195  SVal getSVal(const Stmt *S) const {
196    return getState()->getSVal(S, getLocationContext());
197  }
198
199  /// \brief Generates a new transition in the program state graph
200  /// (ExplodedGraph). Uses the default CheckerContext predecessor node.
201  ///
202  /// @param State The state of the generated node. If not specified, the state
203  ///        will not be changed, but the new node will have the checker's tag.
204  /// @param Tag The tag is used to uniquely identify the creation site. If no
205  ///        tag is specified, a default tag, unique to the given checker,
206  ///        will be used. Tags are used to prevent states generated at
207  ///        different sites from caching out.
208  ExplodedNode *addTransition(ProgramStateRef State = nullptr,
209                              const ProgramPointTag *Tag = nullptr) {
210    return addTransitionImpl(State ? State : getState(), false, nullptr, Tag);
211  }
212
213  /// \brief Generates a new transition with the given predecessor.
214  /// Allows checkers to generate a chain of nodes.
215  ///
216  /// @param State The state of the generated node.
217  /// @param Pred The transition will be generated from the specified Pred node
218  ///             to the newly generated node.
219  /// @param Tag The tag to uniquely identify the creation site.
220  ExplodedNode *addTransition(ProgramStateRef State,
221                              ExplodedNode *Pred,
222                              const ProgramPointTag *Tag = nullptr) {
223    return addTransitionImpl(State, false, Pred, Tag);
224  }
225
226  /// \brief Generate a sink node. Generating a sink stops exploration of the
227  /// given path. To create a sink node for the purpose of reporting an error,
228  /// checkers should use generateErrorNode() instead.
229  ExplodedNode *generateSink(ProgramStateRef State, ExplodedNode *Pred,
230                             const ProgramPointTag *Tag = nullptr) {
231    return addTransitionImpl(State ? State : getState(), true, Pred, Tag);
232  }
233
234  /// \brief Generate a transition to a node that will be used to report
235  /// an error. This node will be a sink. That is, it will stop exploration of
236  /// the given path.
237  ///
238  /// @param State The state of the generated node.
239  /// @param Tag The tag to uniquely identify the creation site. If null,
240  ///        the default tag for the checker will be used.
241  ExplodedNode *generateErrorNode(ProgramStateRef State = nullptr,
242                                  const ProgramPointTag *Tag = nullptr) {
243    return generateSink(State, Pred,
244                       (Tag ? Tag : Location.getTag()));
245  }
246
247  /// \brief Generate a transition to a node that will be used to report
248  /// an error. This node will not be a sink. That is, exploration will
249  /// continue along this path.
250  ///
251  /// @param State The state of the generated node.
252  /// @param Tag The tag to uniquely identify the creation site. If null,
253  ///        the default tag for the checker will be used.
254  ExplodedNode *
255  generateNonFatalErrorNode(ProgramStateRef State = nullptr,
256                            const ProgramPointTag *Tag = nullptr) {
257    return addTransition(State, (Tag ? Tag : Location.getTag()));
258  }
259
260  /// \brief Emit the diagnostics report.
261  void emitReport(std::unique_ptr<BugReport> R) {
262    Changed = true;
263    Eng.getBugReporter().emitReport(std::move(R));
264  }
265
266  /// \brief Returns the word that should be used to refer to the declaration
267  /// in the report.
268  StringRef getDeclDescription(const Decl *D);
269
270  /// \brief Get the declaration of the called function (path-sensitive).
271  const FunctionDecl *getCalleeDecl(const CallExpr *CE) const;
272
273  /// \brief Get the name of the called function (path-sensitive).
274  StringRef getCalleeName(const FunctionDecl *FunDecl) const;
275
276  /// \brief Get the identifier of the called function (path-sensitive).
277  const IdentifierInfo *getCalleeIdentifier(const CallExpr *CE) const {
278    const FunctionDecl *FunDecl = getCalleeDecl(CE);
279    if (FunDecl)
280      return FunDecl->getIdentifier();
281    else
282      return nullptr;
283  }
284
285  /// \brief Get the name of the called function (path-sensitive).
286  StringRef getCalleeName(const CallExpr *CE) const {
287    const FunctionDecl *FunDecl = getCalleeDecl(CE);
288    return getCalleeName(FunDecl);
289  }
290
291  /// \brief Returns true if the callee is an externally-visible function in the
292  /// top-level namespace, such as \c malloc.
293  ///
294  /// If a name is provided, the function must additionally match the given
295  /// name.
296  ///
297  /// Note that this deliberately excludes C++ library functions in the \c std
298  /// namespace, but will include C library functions accessed through the
299  /// \c std namespace. This also does not check if the function is declared
300  /// as 'extern "C"', or if it uses C++ name mangling.
301  static bool isCLibraryFunction(const FunctionDecl *FD,
302                                 StringRef Name = StringRef());
303
304  /// \brief Depending on wither the location corresponds to a macro, return
305  /// either the macro name or the token spelling.
306  ///
307  /// This could be useful when checkers' logic depends on whether a function
308  /// is called with a given macro argument. For example:
309  ///   s = socket(AF_INET,..)
310  /// If AF_INET is a macro, the result should be treated as a source of taint.
311  ///
312  /// \sa clang::Lexer::getSpelling(), clang::Lexer::getImmediateMacroName().
313  StringRef getMacroNameOrSpelling(SourceLocation &Loc);
314
315private:
316  ExplodedNode *addTransitionImpl(ProgramStateRef State,
317                                 bool MarkAsSink,
318                                 ExplodedNode *P = nullptr,
319                                 const ProgramPointTag *Tag = nullptr) {
320    // The analyzer may stop exploring if it sees a state it has previously
321    // visited ("cache out"). The early return here is a defensive check to
322    // prevent accidental caching out by checker API clients. Unless there is a
323    // tag or the client checker has requested that the generated node be
324    // marked as a sink, we assume that a client requesting a transition to a
325    // state that is the same as the predecessor state has made a mistake. We
326    // return the predecessor rather than cache out.
327    //
328    // TODO: We could potentially change the return to an assertion to alert
329    // clients to their mistake, but several checkers (including
330    // DereferenceChecker, CallAndMessageChecker, and DynamicTypePropagation)
331    // rely upon the defensive behavior and would need to be updated.
332    if (!State || (State == Pred->getState() && !Tag && !MarkAsSink))
333      return Pred;
334
335    Changed = true;
336    const ProgramPoint &LocalLoc = (Tag ? Location.withTag(Tag) : Location);
337    if (!P)
338      P = Pred;
339
340    ExplodedNode *node;
341    if (MarkAsSink)
342      node = NB.generateSink(LocalLoc, State, P);
343    else
344      node = NB.generateNode(LocalLoc, State, P);
345    return node;
346  }
347};
348
349} // end GR namespace
350
351} // end clang namespace
352
353#endif
354