24 #include "llvm/ADT/SmallString.h"
25 #include "llvm/ADT/StringExtras.h"
26 #include "llvm/Support/raw_ostream.h"
28 using namespace clang;
31 using llvm::FoldingSetNodeID;
38 if (
const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(E)) {
39 return DRE->getDecl()->getType()->isReferenceType();
54 assert(B->isAssignmentOp());
58 else if (
const UnaryOperator *U = dyn_cast<UnaryOperator>(E)) {
59 if (U->getOpcode() == UO_Deref)
62 else if (
const MemberExpr *ME = dyn_cast<MemberExpr>(E)) {
71 else if (
const ObjCIvarRefExpr *IvarRef = dyn_cast<ObjCIvarRefExpr>(E)) {
95 if (
const ReturnStmt *RS = dyn_cast<ReturnStmt>(S))
96 return RS->getRetValue();
104 std::unique_ptr<PathDiagnosticPiece>
119 auto P = llvm::make_unique<PathDiagnosticEventPiece>(
144 bool EnableNullFPSuppression;
148 : StackFrame(Frame), Mode(Initial), EnableNullFPSuppression(Suppressed) {}
150 static void *getTag() {
152 return static_cast<void *
>(&Tag);
155 void Profile(llvm::FoldingSetNodeID &
ID)
const override {
156 ID.AddPointer(ReturnVisitor::getTag());
157 ID.AddPointer(StackFrame);
158 ID.AddBoolean(EnableNullFPSuppression);
170 bool InEnableNullFPSuppression) {
177 if (CEE->getCalleeContext()->getCallSite() ==
S)
180 if (SP->getStmt() ==
S)
206 if (cast<Expr>(S)->isGLValue())
208 RetVal = State->getSVal(*LValue);
211 SubEngine *Eng = State->getStateManager().getOwningEngine();
212 assert(Eng &&
"Cannot file a bug report without an owning engine");
215 bool EnableNullFPSuppression =
false;
218 EnableNullFPSuppression = State->isNull(*RetLoc).isConstrainedTrue();
221 BR.
addVisitor(llvm::make_unique<ReturnVisitor>(CalleeContext,
222 EnableNullFPSuppression));
250 SVal V = State->getSVal(Ret, StackFrame);
258 assert(RetE &&
"Tracking a return value for a void function");
264 SVal RValue = State->getRawSVal(*LValue, RetE->
getType());
279 if (!State->isNull(V).isConstrainedTrue()) {
281 ReturnVisitor::addVisitorIfNecessary(N, RetE, BR,
282 EnableNullFPSuppression);
288 EnableNullFPSuppression);
292 llvm::raw_svector_ostream Out(Msg);
300 if (EnableNullFPSuppression && hasCounterSuppression(Options))
301 Mode = MaybeUnsuppress;
304 Out <<
"Returning nil";
306 Out <<
"Returning null pointer";
308 Out <<
"Returning zero";
312 if (
const MemRegion *MR = LValue->getAsRegion()) {
313 if (MR->canPrintPretty()) {
314 Out <<
" (reference to ";
315 MR->printPretty(Out);
321 if (
const DeclRefExpr *DR = dyn_cast<DeclRefExpr>(RetE))
322 if (
const DeclaratorDecl *DD = dyn_cast<DeclaratorDecl>(DR->getDecl()))
323 Out <<
" (loaded from '" << *DD <<
"')";
327 if (!L.isValid() || !L.asLocation().isValid())
340 assert(hasCounterSuppression(Options));
348 if (CE->getCalleeContext() != StackFrame)
361 for (
unsigned I = 0,
E = Call->getNumArgs();
I !=
E; ++
I) {
366 const Expr *ArgE = Call->getArgExpr(
I);
371 if (!State->isNull(*ArgV).isConstrainedTrue())
375 EnableNullFPSuppression))
392 return visitNodeInitial(N, PrevN, BRC, BR);
393 case MaybeUnsuppress:
394 return visitNodeMaybeUnsuppress(N, PrevN, BRC, BR);
399 llvm_unreachable(
"Invalid visit mode!");
405 if (EnableNullFPSuppression)
406 BR.
markInvalid(ReturnVisitor::getTag(), StackFrame);
418 ID.AddBoolean(EnableNullFPSuppression);
459 const Expr *InitE =
nullptr;
460 bool IsParam =
false;
463 if (
const VarRegion *VR = dyn_cast<VarRegion>(R)) {
466 InitE = VR->getDecl()->getInit();
474 if (FieldReg && FieldReg == R) {
476 InitE = PIP->getInitializer()->getInit();
486 if (Succ->
getState()->getSVal(R) != V)
489 if (Pred->
getState()->getSVal(R) == V) {
491 if (!PS || PS->getLocationValue() != R)
501 if (BO->isAssignmentOp())
502 InitE = BO->getRHS();
509 if (
const VarRegion *VR = dyn_cast<VarRegion>(R)) {
510 const ParmVarDecl *Param = cast<ParmVarDecl>(VR->getDecl());
525 InitE = TmpR->getExpr();
540 EnableNullFPSuppression);
543 BR, EnableNullFPSuppression);
549 llvm::raw_svector_ostream os(sbuf);
552 const Stmt *S = PS->getStmt();
553 const char *action =
nullptr;
560 }
else if (isa<BlockExpr>(S)) {
562 "Captured by block as ";
566 SVal V = State->getSVal(S, PS->getLocationContext());
568 dyn_cast_or_null<BlockDataRegion>(V.
getAsRegion())) {
569 if (
const VarRegion *OriginalR = BDR->getOriginalRegion(VR)) {
571 State->getSVal(OriginalR).getAs<
KnownSVal>())
572 BR.
addVisitor(llvm::make_unique<FindLastStoreBRVisitor>(
573 *KV, OriginalR, EnableNullFPSuppression));
589 if (TR->getValueType()->isObjCObjectPointerType()) {
590 os << action <<
"nil";
597 os << action <<
"a null pointer value";
600 os << action << CVal->getValue();
604 if (isa<VarRegion>(R)) {
608 <<
" to a garbage value";
611 <<
" without an initial value";
622 if (
const VarRegion *VR = dyn_cast<VarRegion>(R)) {
623 const ParmVarDecl *Param = cast<ParmVarDecl>(VR->getDecl());
629 os <<
"nil object reference";
631 os <<
"null pointer value";
633 os <<
"uninitialized value";
636 os <<
"the value " << CI->getValue();
643 os <<
" via " << Idx << llvm::getOrdinalSuffix(Idx) <<
" parameter";
651 if (os.str().empty()) {
656 if (TR->getValueType()->isObjCObjectPointerType()) {
657 os <<
"nil object reference stored";
664 os <<
"Null pointer value stored";
666 os <<
"Storing null pointer value";
671 os <<
"Uninitialized value stored";
673 os <<
"Storing uninitialized value";
678 os <<
"The value " << CV->getValue() <<
" is assigned";
680 os <<
"Assigning " << CV->getValue();
684 os <<
"Value assigned";
686 os <<
"Assigning value";
714 ID.AddBoolean(Assumption);
721 return "TrackConstraintBRVisitor";
724 bool TrackConstraintBRVisitor::isUnderconstrained(
const ExplodedNode *N)
const {
726 return N->
getState()->isNull(Constraint).isUnderconstrained();
727 return (
bool)N->
getState()->assume(Constraint, !Assumption);
740 if (!IsTrackingTurnedOn)
741 if (!isUnderconstrained(N))
742 IsTrackingTurnedOn =
true;
743 if (!IsTrackingTurnedOn)
748 if (isUnderconstrained(PrevN)) {
755 assert(!isUnderconstrained(N));
760 llvm::raw_svector_ostream os(sbuf);
763 os <<
"Assuming pointer value is ";
764 os << (Assumption ?
"non-null" :
"null");
767 if (os.str().empty())
787 : V(Value), IsSatisfied(
false), IsTrackingTurnedOn(
false) {
791 assert(Eng &&
"Cannot file a bug report without an owning engine");
796 assert(N->
getState()->isNull(V).isConstrainedTrue() &&
797 "The visitor only tracks the cases where V is constrained to 0");
819 if (!IsTrackingTurnedOn)
820 if (Succ->
getState()->isNull(V).isConstrainedTrue())
821 IsTrackingTurnedOn =
true;
822 if (!IsTrackingTurnedOn)
827 if (!Pred->
getState()->isNull(V).isConstrainedTrue()) {
830 assert(Succ->
getState()->isNull(V).isConstrainedTrue());
835 if (CurLC != ReportLC && !CurLC->
isParentOf(ReportLC)) {
854 const Stmt *CurTerminatorStmt =
nullptr;
856 CurTerminatorStmt = BE->getSrc()->getTerminator().getStmt();
858 const Stmt *CurStmt = SP->getStmt();
859 if (!CurStmt->getLocStart().isMacroID())
862 CFGStmtMap *
Map = CurLC->getAnalysisDeclContext()->getCFGStmtMap();
868 if (!CurTerminatorStmt)
888 if (
const DeclRefExpr *DR = dyn_cast<DeclRefExpr>(E)) {
889 if (
const VarDecl *VD = dyn_cast<VarDecl>(DR->getDecl())) {
890 if (!VD->getType()->isReferenceType())
914 if (
auto *POE = dyn_cast<PseudoObjectExpr>(Ex)) {
916 if (PropRef && PropRef->isMessagingGetter()) {
917 const Expr *GetterMessageSend =
918 POE->getSemanticExpr(POE->getNumSemanticExprs() - 1);
919 assert(isa<ObjCMessageExpr>(GetterMessageSend));
932 const CFGBlock *srcBlk = BE->getSrc();
935 bool TookTrueBranch = (*(srcBlk->
succ_begin()) == BE->getDst());
952 bool EnableNullFPSuppression) {
956 if (
const Expr *Ex = dyn_cast<Expr>(S)) {
957 Ex = Ex->IgnoreParenCasts();
963 const Expr *Inner =
nullptr;
964 if (
const Expr *Ex = dyn_cast<Expr>(S)) {
970 if (IsArg && !Inner) {
979 if (ps->getStmt() == S || ps->getStmt() == Inner)
982 if (CEE->getCalleeContext()->getCallSite() == S ||
983 CEE->getCalleeContext()->getCallSite() == Inner)
1012 if (
P->getStmt() == Inner)
1017 assert(LVNode &&
"Unable to find the lvalue node.");
1021 if (LVState->isNull(LVal).isConstrainedTrue()) {
1036 report.
addVisitor(llvm::make_unique<FindLastStoreBRVisitor>(
1037 *KV, RR, EnableNullFPSuppression));
1047 report.
addVisitor(llvm::make_unique<UndefOrNullArgVisitor>(R));
1051 report.
addVisitor(llvm::make_unique<TrackConstraintBRVisitor>(
1056 if (!DV->isZeroConstant() && LVState->isNull(*DV).isConstrainedTrue() &&
1057 EnableNullFPSuppression) {
1059 llvm::make_unique<SuppressInlineDefensiveChecksVisitor>(*DV,
1065 report.
addVisitor(llvm::make_unique<FindLastStoreBRVisitor>(
1066 *KV, R, EnableNullFPSuppression));
1077 if (
const Expr *
E = dyn_cast<Expr>(S))
1078 S =
E->IgnoreParenCasts();
1080 ReturnVisitor::addVisitorIfNecessary(N, S, report, EnableNullFPSuppression);
1091 if (
const Expr *
E = dyn_cast<Expr>(S))
1092 RVal = state->getRawSVal(L.getValue(),
E->getType());
1094 RVal = state->getSVal(L->getRegion());
1097 report.
addVisitor(llvm::make_unique<UndefOrNullArgVisitor>(L->getRegion()));
1099 if (RegionRVal && isa<SymbolicRegion>(RegionRVal)) {
1101 report.
addVisitor(llvm::make_unique<TrackConstraintBRVisitor>(
1117 if (state->isNull(V).isConstrainedTrue())
1131 const Stmt *S = P->getStmt();
1137 llvm::raw_svector_ostream OS(Buf);
1141 ME->getSelector().print(OS);
1142 OS <<
"' not called";
1145 OS <<
"No method is called";
1147 OS <<
" because the receiver is nil";
1163 bool EnableNullFPSuppression) {
1166 WorkList.push_back(S);
1168 while (!WorkList.empty()) {
1169 const Stmt *Head = WorkList.front();
1170 WorkList.pop_front();
1175 if (
const DeclRefExpr *DR = dyn_cast<DeclRefExpr>(Head)) {
1176 if (
const VarDecl *VD = dyn_cast<VarDecl>(DR->getDecl())) {
1185 BR.
addVisitor(llvm::make_unique<FindLastStoreBRVisitor>(
1191 for (
const Stmt *SubStmt : Head->children())
1192 WorkList.push_back(SubStmt);
1203 return "ConditionBRVisitor";
1214 ev->setPrunable(
true,
false);
1231 if (CurrentState->getGDM().getRoot() ==
1232 PrevState->getGDM().getRoot())
1238 const CFGBlock *srcBlk = BE->getSrc();
1247 const std::pair<const ProgramPointTag *, const ProgramPointTag *> &tags =
1249 getEngine().geteagerlyAssumeBinOpBifurcationTags();
1252 if (tag == tags.first)
1255 if (tag == tags.second)
1272 const Expr *Cond =
nullptr;
1274 switch (Term->getStmtClass()) {
1277 case Stmt::IfStmtClass:
1278 Cond = cast<IfStmt>(Term)->getCond();
1280 case Stmt::ConditionalOperatorClass:
1281 Cond = cast<ConditionalOperator>(Term)->getCond();
1287 const bool tookTrue = *(srcBlk->
succ_begin()) == dstBlk;
1298 const Expr *Ex = Cond;
1302 switch (Ex->getStmtClass()) {
1305 case Stmt::BinaryOperatorClass:
1306 return VisitTrueTest(Cond, cast<BinaryOperator>(Ex), tookTrue, BRC,
1308 case Stmt::DeclRefExprClass:
1309 return VisitTrueTest(Cond, cast<DeclRefExpr>(Ex), tookTrue, BRC,
1311 case Stmt::UnaryOperatorClass: {
1314 tookTrue = !tookTrue;
1329 const Expr *OriginalExpr = Ex;
1332 if (
const DeclRefExpr *DR = dyn_cast<DeclRefExpr>(Ex)) {
1333 const bool quotes = isa<VarDecl>(DR->getDecl());
1350 Out << DR->getDecl()->getDeclName().getAsString();
1359 if (IL->getValue() == 0) {
1365 if (IL->getValue() == 0) {
1371 Out << IL->getValue();
1381 const bool tookTrue,
1386 bool shouldInvert =
false;
1391 llvm::raw_svector_ostream OutLHS(LhsString), OutRHS(RhsString);
1397 shouldInvert = !isVarLHS && isVarRHS;
1411 if (LhsString.empty() || RhsString.empty() ||
1417 llvm::raw_svector_ostream Out(buf);
1418 Out <<
"Assuming " << (shouldInvert ? RhsString : LhsString) <<
" is ";
1424 case BO_LT: Op = BO_GT;
break;
1425 case BO_GT: Op = BO_LT;
break;
1426 case BO_LE: Op = BO_GE;
break;
1427 case BO_GE: Op = BO_LE;
break;
1432 case BO_EQ: Op = BO_NE;
break;
1433 case BO_NE: Op = BO_EQ;
break;
1434 case BO_LT: Op = BO_GE;
break;
1435 case BO_GT: Op = BO_LE;
break;
1436 case BO_LE: Op = BO_GT;
break;
1437 case BO_GE: Op = BO_LT;
break;
1447 Out <<
"not equal to ";
1454 Out << (shouldInvert ? LhsString : RhsString);
1458 new PathDiagnosticEventPiece(
Loc, Out.str());
1459 if (shouldPrune.hasValue())
1466 const Expr *CondVarExpr,
1467 const bool tookTrue,
1475 llvm::raw_svector_ostream Out(buf);
1476 Out <<
"Assuming " << LhsString <<
" is ";
1481 Out << (tookTrue ?
"not null" :
"null");
1483 Out << (tookTrue ?
"not nil" :
"nil");
1485 Out << (tookTrue ?
"true" :
"false");
1487 Out << (tookTrue ?
"non-zero" :
"zero");
1494 new PathDiagnosticEventPiece(
Loc, Out.str());
1496 if (
const DeclRefExpr *DR = dyn_cast<DeclRefExpr>(CondVarExpr)) {
1497 if (
const VarDecl *VD = dyn_cast<VarDecl>(DR->getDecl())) {
1501 event->setPrunable(
false);
1512 const bool tookTrue,
1522 llvm::raw_svector_ostream Out(Buf);
1524 Out <<
"Assuming '" << VD->
getDeclName() <<
"' is ";
1529 Out << (tookTrue ?
"non-null" :
"null");
1531 Out << (tookTrue ?
"non-nil" :
"nil");
1533 Out << (tookTrue ?
"not equal to 0" :
"0");
1540 new PathDiagnosticEventPiece(
Loc, Out.str());
1543 if (
const MemRegion *R = state->getLValue(VD, LCtx).getAsRegion()) {
1545 event->setPrunable(
false);
1547 SVal V = state->getSVal(R);
1549 event->setPrunable(
false);
1555 std::unique_ptr<PathDiagnosticPiece>
1583 if (CD->
getName() ==
"list") {
1593 if (CD->
getName() ==
"__independent_bits_engine") {
1612 if (CD->
getName() ==
"basic_string") {
1620 if (CD->
getName() ==
"shared_ptr") {
1634 if (SM.
getFilename(Loc).endswith(
"sys/queue.h")) {
1664 I !=
E; ++
I, ++Idx) {
1665 const MemRegion *ArgReg = Call->getArgSVal(Idx).getAsRegion();
1673 assert(ParamDecl &&
"Formal parameter has no decl?");
1688 SVal BoundVal = State->getSVal(R);
ObjCPropertyRefExpr - A dot-syntax expression to access an ObjC property.
TypedValueRegion - An abstract class representing regions having a typed value.
const Expr * getDerefExpr(const Stmt *S)
StringRef getName() const
getName - Get the name of identifier for this declaration as a StringRef.
void setTag(const char *tag)
Tag this PathDiagnosticPiece with the given C-string.
This is a discriminated union of FileInfo and ExpansionInfo.
A (possibly-)qualified type.
MemRegion - The root abstract class for all memory regions.
bool isInteresting(SymbolRef sym)
succ_iterator succ_begin()
virtual bool canPrintPretty() const
Returns true if this region can be printed in a user-friendly way.
const ExplodedNode * getErrorNode() const
virtual PathDiagnosticLocation getLocation(const SourceManager &SM) const
Return the "definitive" location of the reported bug.
bool shouldSuppressNullReturnPaths()
Returns whether or not paths that go through null returns should be suppressed.
PathDiagnosticPiece * VisitNode(const ExplodedNode *N, const ExplodedNode *PrevN, BugReporterContext &BRC, BugReport &BR) override
Return a diagnostic piece which should be associated with the given node.
unsigned getFunctionScopeIndex() const
Returns the index of this parameter in its prototype or method scope.
ProgramPoint getLocation() const
getLocation - Returns the edge associated with the given node.
Represents a point when we begin processing an inlined call.
virtual bool isBoundable() const
const SrcMgr::SLocEntry & getSLocEntry(FileID FID, bool *Invalid=nullptr) const
Manages the lifetime of CallEvent objects.
PathDiagnosticPiece * VisitNode(const ExplodedNode *N, const ExplodedNode *PrevN, BugReporterContext &BRC, BugReport &BR) override
Return a diagnostic piece which should be associated with the given node.
Each ExpansionInfo encodes the expansion location - where the token was ultimately expanded...
const ExpansionInfo & getExpansion() const
const Expr * getInit() const
bool isBooleanType() const
MemSpaceRegion - A memory region that represents a "memory space"; for example, the set of global var...
void setPrunable(bool isPrunable, bool override=false)
Mark the diagnostic piece as being potentially prunable.
PathDiagnosticPiece * VisitNode(const ExplodedNode *N, const ExplodedNode *Prev, BugReporterContext &BRC, BugReport &BR) override
Return a diagnostic piece which should be associated with the given node.
bool shouldAvoidSuppressingNullArgumentPaths()
Returns whether a bug report should not be suppressed if its path includes a call with a null argumen...
const Stmt * GetDenomExpr(const ExplodedNode *N)
Represents a C++ constructor within a class.
Value representing integer constant.
VarDecl - An instance of this class is created to represent a variable declaration or definition...
unsigned succ_size() const
static const Expr * peelOffOuterExpr(const Expr *Ex, const ExplodedNode *N)
Represents an expression – generally a full-expression – that introduces cleanups to be run at the en...
ParmVarDecl - Represents a parameter to a function.
bool isZeroConstant() const
FullSourceLoc asLocation() const
bool isComparisonOp() const
const MemSpaceRegion * getMemorySpace() const
void Profile(llvm::FoldingSetNodeID &ID) const override
bool isScalarType() const
bool isReferenceType() const
bool isAnyPointerType() const
Represents a program point after a store evaluation.
This class provides a convenience implementation for clone() using the Curiously-Recurring Template P...
MemRegionManager & getRegionManager()
SymbolRef getAsLocSymbol(bool IncludeBaseRegions=false) const
If this SVal is a location and wraps a symbol, return that SymbolRef.
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
Optional< T > getLocationAs() const LLVM_LVALUE_FUNCTION
bool patternMatch(const Expr *Ex, raw_ostream &Out, BugReporterContext &BRC, BugReport &R, const ExplodedNode *N, Optional< bool > &prunable)
const VarDecl * getDecl() const
virtual llvm::iterator_range< ranges_iterator > getRanges()
Get the SourceRanges associated with the report.
std::unique_ptr< PathDiagnosticPiece > getEndPath(BugReporterContext &BRC, const ExplodedNode *N, BugReport &BR) override
Provide custom definition for the final diagnostic piece on the path - the piece, which is displayed ...
virtual std::unique_ptr< PathDiagnosticPiece > getEndPath(BugReporterContext &BRC, const ExplodedNode *N, BugReport &BR)
Provide custom definition for the final diagnostic piece on the path - the piece, which is displayed ...
BlockDataRegion - A region that represents a block instance.
static bool isInStdNamespace(const Decl *D)
Returns true if the root namespace of the given declaration is the 'std' C++ namespace.
const CXXRecordDecl * getParent() const
Returns the parent of this method declaration, which is the class in which this method is defined...
bool isUnknownOrUndef() const
A builtin binary operation expression such as "x + y" or "x <= y".
const Stmt * getCallSite() const
bool isParentOf(const LocationContext *LC) const
Expr * IgnoreParenCasts() LLVM_READONLY
IgnoreParenCasts - Ignore parentheses and casts.
static void registerStatementVarDecls(BugReport &BR, const Stmt *S, bool EnableNullFPSuppression)
Creates a visitor for every VarDecl inside a Stmt and registers it with the BugReport.
static PathDiagnosticLocation create(const Decl *D, const SourceManager &SM)
Create a location corresponding to the given declaration.
static const MemRegion * getLocationRegionIfReference(const Expr *E, const ExplodedNode *N)
StringRef getDescription() const
ExplodedNode * getFirstPred()
bool isStaticLocal() const
isStaticLocal - Returns true if a variable with function scope is a static local variable.
detail::InMemoryDirectory::const_iterator I
void addVisitor(std::unique_ptr< BugReporterVisitor > visitor)
Add custom or predefined bug report visitors to this report.
const LocationContext * getLocationContext() const
const StackFrameContext * getStackFrame() const
ConditionalOperator - The ?: ternary operator.
bool isAssignmentOp() const
bool shouldSuppressInlinedDefensiveChecks()
Returns whether or not diagnostics containing inlined defensive NULL checks should be suppressed...
Represents a ValueDecl that came out of a declarator.
StringRef getFilename(SourceLocation SpellingLoc) const
Return the filename of the file containing a SourceLocation.
CFGBlock - Represents a single basic block in a source-level CFG.
const MemRegion * StripCasts(bool StripBaseCasts=true) const
static const char * getTag()
Return the tag associated with this visitor.
Represents a point when we finish the call exit sequence (for inlined call).
QualType getPointeeType() const
If this is a pointer, ObjC object pointer, or block pointer, this returns the respective pointee...
ProgramState - This class encapsulates:
Expr - This represents one expression.
const ProgramStateRef & getState() const
CFGBlock * getBlock(Stmt *S)
Returns the CFGBlock the specified Stmt* appears in.
CallEventRef getCaller(const StackFrameContext *CalleeCtx, ProgramStateRef State)
SVal getSVal(const Stmt *S, const LocationContext *LCtx) const
Returns the SVal bound to the statement 'S' in the state's environment.
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type...
static const Expr * getNilReceiver(const Stmt *S, const ExplodedNode *N)
If the statement is a message send expression with nil receiver, returns the receiver expression...
void Profile(llvm::FoldingSetNodeID &ID) const override
SuppressInlineDefensiveChecksVisitor(DefinedSVal Val, const ExplodedNode *N)
Expr * getSubExpr() const
DeclContext * getParent()
getParent - Returns the containing DeclContext.
ReturnStmt - This represents a return, optionally of an expression: return; return 4;...
An expression that sends a message to the given Objective-C object or class.
UnaryOperator - This represents the unary-expression's (except sizeof and alignof), the postinc/postdec operators from postfix-expression, and various extensions.
DeclarationName getDeclName() const
getDeclName - Get the actual, stored name of the declaration, which may be a special name...
void markInteresting(SymbolRef sym)
PathDiagnosticPiece * VisitTerminator(const Stmt *Term, const ExplodedNode *N, const CFGBlock *srcBlk, const CFGBlock *dstBlk, BugReport &R, BugReporterContext &BRC)
const MatchFinder::MatchFinderOptions & Options
CFGTerminator getTerminator()
OpaqueValueExpr - An expression referring to an opaque object of a fixed type and value class...
static std::unique_ptr< PathDiagnosticPiece > getDefaultEndPath(BugReporterContext &BRC, const ExplodedNode *N, BugReport &BR)
Generates the default final diagnostic piece.
bool isIntegralOrEnumerationType() const
Determine whether this type is an integral or enumeration type.
Encodes a location in the source.
const StackFrameContext * getCurrentStackFrame() const
static bool isCallStmt(const Stmt *S)
Returns true if this is a statement is a function or method call of some kind.
ProgramPoints can be "tagged" as representing points specific to a given analysis entity...
AnalysisManager & getAnalysisManager() override
void Profile(llvm::FoldingSetNodeID &ID) const override
bool isValid() const
Return true if this is a valid SourceLocation object.
CallEventManager & getCallEventManager()
DeclStmt - Adaptor class for mixing declarations with statements and expressions. ...
PathDiagnosticPiece * VisitNode(const ExplodedNode *N, const ExplodedNode *PrevN, BugReporterContext &BRC, BugReport &BR) override
Return a diagnostic piece which should be associated with the given node.
Represents a static or instance method of a struct/union/class.
PathDiagnosticPiece * VisitNode(const ExplodedNode *N, const ExplodedNode *PrevN, BugReporterContext &BRC, BugReport &BR) override
Return a diagnostic piece which should be associated with the given node.
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
void Profile(llvm::FoldingSetNodeID &ID, const ASTContext &Ctx)
PathDiagnosticPiece * VisitTrueTest(const Expr *Cond, bool tookTrue, BugReporterContext &BRC, BugReport &R, const ExplodedNode *N)
AnalyzerOptions & options
const Decl * getDecl() const
virtual void printPretty(raw_ostream &os) const
Print the region for use in diagnostics.
PathDiagnosticPiece * VisitConditionVariable(StringRef LhsString, const Expr *CondVarExpr, const bool tookTrue, BugReporterContext &BRC, BugReport &R, const ExplodedNode *N)
const Decl * getSingleDecl() const
Expr * getInstanceReceiver()
Returns the object expression (receiver) for an instance message, or null for a message that is not a...
ast_type_traits::DynTypedNode Node
bool isDeclRefExprToReference(const Expr *E)
const LocationContext * getParent() const
StringRef getOpcodeStr() const
const LocationContext * getLocationContext() const
const VarRegion * getVarRegion(const VarDecl *D, const LocationContext *LC)
getVarRegion - Retrieve or create the memory region associated with a specified VarDecl and LocationC...
static const char * getTag()
Return the tag associated with this visitor.
GRBugReporter & getBugReporter()
const Stmt * GetRetValExpr(const ExplodedNode *N)
detail::InMemoryDirectory::const_iterator E
const MemRegion * getAsRegion() const
const Expr * getRetValue() const
Optional< T > getAs() const
Convert to the specified ProgramPoint type, returning None if this ProgramPoint is not of the desired...
unsigned Map[Count]
The type of a lookup table which maps from language-specific address spaces to target-specific ones...
Represents an SVal that is guaranteed to not be UnknownVal.
ArraySubscriptExpr - [C99 6.5.2.1] Array Subscripting.
ProgramStateManager & getStateManager()
bool shouldSuppressFromCXXStandardLibrary()
Returns whether or not diagnostics reported within the C++ standard library should be suppressed...
ObjCIvarRefExpr - A reference to an ObjC instance variable.
X
Add a minimal nested name specifier fixit hint to allow lookup of a tag name from an outer enclosing ...
MemberExpr - [C99 6.5.2.3] Structure and Union Members.
Represents a C++ struct/union/class.
bool isObjCObjectPointerType() const
PathDiagnosticPiece * VisitNode(const ExplodedNode *Succ, const ExplodedNode *Pred, BugReporterContext &BRC, BugReport &BR) override
Return a diagnostic piece which should be associated with the given node.
bool trackNullOrUndefValue(const ExplodedNode *N, const Stmt *S, BugReport &R, bool IsArg=false, bool EnableNullFPSuppression=true)
Attempts to add visitors to trace a null or undefined value back to its point of origin, whether it is a symbol constrained to null or an explicit assignment.
PathDiagnosticPiece * VisitNodeImpl(const ExplodedNode *N, const ExplodedNode *Prev, BugReporterContext &BRC, BugReport &BR)
static PathDiagnosticLocation createEndOfPath(const ExplodedNode *N, const SourceManager &SM)
Create a location corresponding to the next valid ExplodedNode as end of path location.
void removeInvalidation(const void *Tag, const void *Data)
Reverses the effects of a previous invalidation.
bool isFunctionMacroExpansion() const
void markInvalid(const void *Tag, const void *Data)
Marks the current report as invalid, meaning that it is probably a false positive and should not be r...
static bool isInitializationOfVar(const ExplodedNode *N, const VarRegion *VR)
Returns true if N represents the DeclStmt declaring and initializing VR.
Loc getLValue(const VarDecl *D, const LocationContext *LC) const
Get the lvalue for a variable reference.
A SourceLocation and its associated SourceManager.
A reference to a declared variable, function, enum, etc.
virtual bool isSubRegionOf(const MemRegion *R) const
Check if the region is a subregion of the given region.
A trivial tuple used to represent a source range.
This class provides an interface through which checkers can create individual bug reports...
std::pair< FileID, unsigned > getDecomposedLoc(SourceLocation Loc) const
Decompose the specified location into a raw FileID + Offset pair.
bool isConstQualified() const
Determine whether this type is const-qualified.
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
static bool isInterestingLValueExpr(const Expr *Ex)
Returns true if nodes for the given expression kind are always kept around.
This class handles loading and caching of source files into memory.
SourceManager & getSourceManager()
bool hasLocalStorage() const
hasLocalStorage - Returns true if a variable with function scope is a non-static local variable...
FullSourceLoc getSpellingLoc() const
virtual AnalysisManager & getAnalysisManager()=0
ExprEngine & getEngine()
getEngine - Return the analysis engine used to analyze a given function or method.
static const char * getTag()
Return the tag associated with this visitor.
bool isPointerType() const