clang  3.9.0
BuiltinFunctionChecker.cpp
Go to the documentation of this file.
1 //=== BuiltinFunctionChecker.cpp --------------------------------*- C++ -*-===//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This checker evaluates clang builtin functions.
11 //
12 //===----------------------------------------------------------------------===//
13 
14 #include "ClangSACheckers.h"
15 #include "clang/Basic/Builtins.h"
19 
20 using namespace clang;
21 using namespace ento;
22 
23 namespace {
24 
25 class BuiltinFunctionChecker : public Checker<eval::Call> {
26 public:
27  bool evalCall(const CallExpr *CE, CheckerContext &C) const;
28 };
29 
30 }
31 
32 bool BuiltinFunctionChecker::evalCall(const CallExpr *CE,
33  CheckerContext &C) const {
35  const FunctionDecl *FD = C.getCalleeDecl(CE);
36  const LocationContext *LCtx = C.getLocationContext();
37  if (!FD)
38  return false;
39 
40  switch (FD->getBuiltinID()) {
41  default:
42  return false;
43 
44  case Builtin::BI__builtin_unpredictable:
45  case Builtin::BI__builtin_expect:
46  case Builtin::BI__builtin_assume_aligned:
47  case Builtin::BI__builtin_addressof: {
48  // For __builtin_unpredictable, __builtin_expect, and
49  // __builtin_assume_aligned, just return the value of the subexpression.
50  // __builtin_addressof is going from a reference to a pointer, but those
51  // are represented the same way in the analyzer.
52  assert (CE->arg_begin() != CE->arg_end());
53  SVal X = state->getSVal(*(CE->arg_begin()), LCtx);
54  C.addTransition(state->BindExpr(CE, LCtx, X));
55  return true;
56  }
57 
58  case Builtin::BI__builtin_alloca: {
59  // FIXME: Refactor into StoreManager itself?
61  const AllocaRegion* R =
63 
64  // Set the extent of the region in bytes. This enables us to use the
65  // SVal of the argument directly. If we save the extent in bits, we
66  // cannot represent values like symbol*8.
68  state->getSVal(*(CE->arg_begin()), LCtx).castAs<DefinedOrUnknownSVal>();
69 
70  SValBuilder& svalBuilder = C.getSValBuilder();
71  DefinedOrUnknownSVal Extent = R->getExtent(svalBuilder);
72  DefinedOrUnknownSVal extentMatchesSizeArg =
73  svalBuilder.evalEQ(state, Extent, Size);
74  state = state->assume(extentMatchesSizeArg, true);
75  assert(state && "The region should not have any previous constraints");
76 
77  C.addTransition(state->BindExpr(CE, LCtx, loc::MemRegionVal(R)));
78  return true;
79  }
80 
81  case Builtin::BI__builtin_object_size: {
82  // This must be resolvable at compile time, so we defer to the constant
83  // evaluator for a value.
84  SVal V = UnknownVal();
85  llvm::APSInt Result;
86  if (CE->EvaluateAsInt(Result, C.getASTContext(), Expr::SE_NoSideEffects)) {
87  // Make sure the result has the correct type.
88  SValBuilder &SVB = C.getSValBuilder();
90  BVF.getAPSIntType(CE->getType()).apply(Result);
91  V = SVB.makeIntVal(Result);
92  }
93 
94  C.addTransition(state->BindExpr(CE, LCtx, V));
95  return true;
96  }
97  }
98 }
99 
100 void ento::registerBuiltinFunctionChecker(CheckerManager &mgr) {
101  mgr.registerChecker<BuiltinFunctionChecker>();
102 }
FunctionDecl - An instance of this class is created to represent a function declaration or definition...
Definition: Decl.h:1561
nonloc::ConcreteInt makeIntVal(const IntegerLiteral *integer)
Definition: SValBuilder.h:237
ExplodedNode * addTransition(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generates a new transition in the program state graph (ExplodedGraph).
Strictly evaluate the expression.
Definition: Expr.h:586
AllocaRegion - A region that represents an untyped blob of bytes created by a call to 'alloca'...
Definition: MemRegion.h:441
const FunctionDecl * getCalleeDecl(const CallExpr *CE) const
Get the declaration of the called function (path-sensitive).
unsigned blockCount() const
Returns the number of times the current block has been visited along the analyzed path...
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
const AllocaRegion * getAllocaRegion(const Expr *Ex, unsigned Cnt, const LocationContext *LC)
getAllocaRegion - Retrieve a region associated with a call to alloca().
Definition: MemRegion.cpp:1090
arg_iterator arg_end()
Definition: Expr.h:2248
DefinedOrUnknownSVal getExtent(SValBuilder &svalBuilder) const override
getExtent - Returns the size of the region in bytes.
Definition: MemRegion.cpp:212
const ProgramStateRef & getState() const
bool EvaluateAsInt(llvm::APSInt &Result, const ASTContext &Ctx, SideEffectsKind AllowSideEffects=SE_NoSideEffects) const
EvaluateAsInt - Return true if this is a constant which we can fold and convert to an integer...
The result type of a method or function.
CHECKER * registerChecker()
Used to register checkers.
StoreManager & getStoreManager()
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
Definition: SVals.h:46
unsigned getBuiltinID() const
Returns a value indicating whether this function corresponds to a builtin function.
Definition: Decl.cpp:2687
QualType getType() const
Definition: Expr.h:126
MemRegionManager & getRegionManager()
getRegionManager - Returns the internal RegionManager object that is used to query and manipulate Mem...
Definition: Store.h:85
BasicValueFactory & getBasicValueFactory()
Definition: SValBuilder.h:139
arg_iterator arg_begin()
Definition: Expr.h:2247
X
Add a minimal nested name specifier fixit hint to allow lookup of a tag name from an outer enclosing ...
Definition: SemaDecl.cpp:12171
SValBuilder & getSValBuilder()
CallExpr - Represents a function call (C99 6.5.2.2, C++ [expr.call]).
Definition: Expr.h:2148
APSIntType getAPSIntType(QualType T) const
Returns the type of the APSInt used to store values of the given QualType.
Defines enum values for all the target-independent builtin functions.
const LocationContext * getLocationContext() const