21 #include "llvm/ADT/SmallString.h"
22 #include "llvm/Support/raw_ostream.h"
24 using namespace clang;
28 class UndefResultChecker
29 :
public Checker< check::PostStmt<BinaryOperator> > {
31 mutable std::unique_ptr<BugType> BT;
42 if (state->getSVal(B, LCtx).isUndef()) {
59 new BuiltinBug(
this,
"Result of operation is garbage or undefined"));
62 llvm::raw_svector_ostream OS(sbuf);
63 const Expr *Ex =
nullptr;
66 if (state->getSVal(B->
getLHS(), LCtx).isUndef()) {
70 else if (state->getSVal(B->
getRHS(), LCtx).isUndef()) {
76 OS <<
"The " << (isLeft ?
"left" :
"right")
79 <<
"' is a garbage value";
83 OS <<
"The result of the '"
85 <<
"' expression is undefined";
87 auto report = llvm::make_unique<BugReport>(*BT, OS.str(), N);
89 report->addRange(Ex->getSourceRange());
FunctionDecl - An instance of this class is created to represent a function declaration or definition...
StringRef getCalleeName(const FunctionDecl *FunDecl) const
Get the name of the called function (path-sensitive).
ExplodedNode * generateErrorNode(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generate a transition to a node that will be used to report an error.
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
A builtin binary operation expression such as "x + y" or "x <= y".
Expr * IgnoreParenCasts() LLVM_READONLY
IgnoreParenCasts - Ignore parentheses and casts.
Expr - This represents one expression.
const ProgramStateRef & getState() const
void emitReport(std::unique_ptr< BugReport > R)
Emit the diagnostics report.
CHECKER * registerChecker()
Used to register checkers.
const Decl * getDecl() const
const StackFrameContext * getStackFrame() const
StringRef getOpcodeStr() const
bool trackNullOrUndefValue(const ExplodedNode *N, const Stmt *S, BugReport &R, bool IsArg=false, bool EnableNullFPSuppression=true)
Attempts to add visitors to trace a null or undefined value back to its point of origin, whether it is a symbol constrained to null or an explicit assignment.
const LocationContext * getLocationContext() const