clang  3.9.0
BugReporterVisitor.h
Go to the documentation of this file.
1 //===--- BugReporterVisitor.h - Generate PathDiagnostics -------*- C++ -*-===//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This file declares BugReporterVisitors, which are used to generate enhanced
11 // diagnostic traces.
12 //
13 //===----------------------------------------------------------------------===//
14 
15 #ifndef LLVM_CLANG_STATICANALYZER_CORE_BUGREPORTER_BUGREPORTERVISITOR_H
16 #define LLVM_CLANG_STATICANALYZER_CORE_BUGREPORTER_BUGREPORTERVISITOR_H
17 
19 #include "llvm/ADT/FoldingSet.h"
20 
21 namespace clang {
22 class CFGBlock;
23 
24 namespace ento {
25 
26 class BugReport;
27 class BugReporterContext;
28 class ExplodedNode;
29 class MemRegion;
30 class PathDiagnosticPiece;
31 
32 /// \brief BugReporterVisitors are used to add custom diagnostics along a path.
33 ///
34 /// Custom visitors should subclass the BugReporterVisitorImpl class for a
35 /// default implementation of the clone() method.
36 /// (Warning: if you have a deep subclass of BugReporterVisitorImpl, the
37 /// default implementation of clone() will NOT do the right thing, and you
38 /// will have to provide your own implementation.)
39 class BugReporterVisitor : public llvm::FoldingSetNode {
40 public:
41  BugReporterVisitor() = default;
42  BugReporterVisitor(const BugReporterVisitor &) = default;
44  virtual ~BugReporterVisitor();
45 
46  /// \brief Returns a copy of this BugReporter.
47  ///
48  /// Custom BugReporterVisitors should not override this method directly.
49  /// Instead, they should inherit from BugReporterVisitorImpl and provide
50  /// a protected or public copy constructor.
51  ///
52  /// (Warning: if you have a deep subclass of BugReporterVisitorImpl, the
53  /// default implementation of clone() will NOT do the right thing, and you
54  /// will have to provide your own implementation.)
55  virtual std::unique_ptr<BugReporterVisitor> clone() const = 0;
56 
57  /// \brief Return a diagnostic piece which should be associated with the
58  /// given node.
59  ///
60  /// The last parameter can be used to register a new visitor with the given
61  /// BugReport while processing a node.
62  virtual PathDiagnosticPiece *VisitNode(const ExplodedNode *Succ,
63  const ExplodedNode *Pred,
64  BugReporterContext &BRC,
65  BugReport &BR) = 0;
66 
67  /// \brief Provide custom definition for the final diagnostic piece on the
68  /// path - the piece, which is displayed before the path is expanded.
69  ///
70  /// If returns NULL the default implementation will be used.
71  /// Also note that at most one visitor of a BugReport should generate a
72  /// non-NULL end of path diagnostic piece.
73  virtual std::unique_ptr<PathDiagnosticPiece>
75 
76  virtual void Profile(llvm::FoldingSetNodeID &ID) const = 0;
77 
78  /// \brief Generates the default final diagnostic piece.
79  static std::unique_ptr<PathDiagnosticPiece>
81  BugReport &BR);
82 };
83 
84 /// This class provides a convenience implementation for clone() using the
85 /// Curiously-Recurring Template Pattern. If you are implementing a custom
86 /// BugReporterVisitor, subclass BugReporterVisitorImpl and provide a public
87 /// or protected copy constructor.
88 ///
89 /// (Warning: if you have a deep subclass of BugReporterVisitorImpl, the
90 /// default implementation of clone() will NOT do the right thing, and you
91 /// will have to provide your own implementation.)
92 template <class DERIVED>
94  std::unique_ptr<BugReporterVisitor> clone() const override {
95  return llvm::make_unique<DERIVED>(*static_cast<const DERIVED *>(this));
96  }
97 };
98 
100  : public BugReporterVisitorImpl<FindLastStoreBRVisitor> {
101  const MemRegion *R;
102  SVal V;
103  bool Satisfied;
104 
105  /// If the visitor is tracking the value directly responsible for the
106  /// bug, we are going to employ false positive suppression.
107  bool EnableNullFPSuppression;
108 
109 public:
110  /// Creates a visitor for every VarDecl inside a Stmt and registers it with
111  /// the BugReport.
112  static void registerStatementVarDecls(BugReport &BR, const Stmt *S,
113  bool EnableNullFPSuppression);
114 
116  bool InEnableNullFPSuppression)
117  : R(R),
118  V(V),
119  Satisfied(false),
120  EnableNullFPSuppression(InEnableNullFPSuppression) {}
121 
122  void Profile(llvm::FoldingSetNodeID &ID) const override;
123 
125  const ExplodedNode *PrevN,
126  BugReporterContext &BRC,
127  BugReport &BR) override;
128 };
129 
131  : public BugReporterVisitorImpl<TrackConstraintBRVisitor> {
132  DefinedSVal Constraint;
133  bool Assumption;
134  bool IsSatisfied;
135  bool IsZeroCheck;
136 
137  /// We should start tracking from the last node along the path in which the
138  /// value is constrained.
139  bool IsTrackingTurnedOn;
140 
141 public:
142  TrackConstraintBRVisitor(DefinedSVal constraint, bool assumption)
143  : Constraint(constraint), Assumption(assumption), IsSatisfied(false),
144  IsZeroCheck(!Assumption && Constraint.getAs<Loc>()),
145  IsTrackingTurnedOn(false) {}
146 
147  void Profile(llvm::FoldingSetNodeID &ID) const override;
148 
149  /// Return the tag associated with this visitor. This tag will be used
150  /// to make all PathDiagnosticPieces created by this visitor.
151  static const char *getTag();
152 
154  const ExplodedNode *PrevN,
155  BugReporterContext &BRC,
156  BugReport &BR) override;
157 
158 private:
159  /// Checks if the constraint is valid in the current state.
160  bool isUnderconstrained(const ExplodedNode *N) const;
161 
162 };
163 
164 /// \class NilReceiverBRVisitor
165 /// \brief Prints path notes when a message is sent to a nil receiver.
167  : public BugReporterVisitorImpl<NilReceiverBRVisitor> {
168 public:
169 
170  void Profile(llvm::FoldingSetNodeID &ID) const override {
171  static int x = 0;
172  ID.AddPointer(&x);
173  }
174 
176  const ExplodedNode *PrevN,
177  BugReporterContext &BRC,
178  BugReport &BR) override;
179 
180  /// If the statement is a message send expression with nil receiver, returns
181  /// the receiver expression. Returns NULL otherwise.
182  static const Expr *getNilReceiver(const Stmt *S, const ExplodedNode *N);
183 };
184 
185 /// Visitor that tries to report interesting diagnostics from conditions.
187  : public BugReporterVisitorImpl<ConditionBRVisitor> {
188 public:
189  void Profile(llvm::FoldingSetNodeID &ID) const override {
190  static int x = 0;
191  ID.AddPointer(&x);
192  }
193 
194  /// Return the tag associated with this visitor. This tag will be used
195  /// to make all PathDiagnosticPieces created by this visitor.
196  static const char *getTag();
197 
199  const ExplodedNode *Prev,
200  BugReporterContext &BRC,
201  BugReport &BR) override;
202 
204  const ExplodedNode *Prev,
205  BugReporterContext &BRC,
206  BugReport &BR);
207 
209  const ExplodedNode *N,
210  const CFGBlock *srcBlk,
211  const CFGBlock *dstBlk,
212  BugReport &R,
213  BugReporterContext &BRC);
214 
216  bool tookTrue,
217  BugReporterContext &BRC,
218  BugReport &R,
219  const ExplodedNode *N);
220 
222  const DeclRefExpr *DR,
223  const bool tookTrue,
224  BugReporterContext &BRC,
225  BugReport &R,
226  const ExplodedNode *N);
227 
229  const BinaryOperator *BExpr,
230  const bool tookTrue,
231  BugReporterContext &BRC,
232  BugReport &R,
233  const ExplodedNode *N);
234 
235  PathDiagnosticPiece *VisitConditionVariable(StringRef LhsString,
236  const Expr *CondVarExpr,
237  const bool tookTrue,
238  BugReporterContext &BRC,
239  BugReport &R,
240  const ExplodedNode *N);
241 
242  bool patternMatch(const Expr *Ex,
243  raw_ostream &Out,
244  BugReporterContext &BRC,
245  BugReport &R,
246  const ExplodedNode *N,
247  Optional<bool> &prunable);
248 };
249 
250 /// \brief Suppress reports that might lead to known false positives.
251 ///
252 /// Currently this suppresses reports based on locations of bugs.
254  : public BugReporterVisitorImpl<LikelyFalsePositiveSuppressionBRVisitor> {
255 public:
256  static void *getTag() {
257  static int Tag = 0;
258  return static_cast<void *>(&Tag);
259  }
260 
261  void Profile(llvm::FoldingSetNodeID &ID) const override {
262  ID.AddPointer(getTag());
263  }
264 
266  const ExplodedNode *Prev,
267  BugReporterContext &BRC,
268  BugReport &BR) override {
269  return nullptr;
270  }
271 
272  std::unique_ptr<PathDiagnosticPiece> getEndPath(BugReporterContext &BRC,
273  const ExplodedNode *N,
274  BugReport &BR) override;
275 };
276 
277 /// \brief When a region containing undefined value or '0' value is passed
278 /// as an argument in a call, marks the call as interesting.
279 ///
280 /// As a result, BugReporter will not prune the path through the function even
281 /// if the region's contents are not modified/accessed by the call.
283  : public BugReporterVisitorImpl<UndefOrNullArgVisitor> {
284 
285  /// The interesting memory region this visitor is tracking.
286  const MemRegion *R;
287 
288 public:
289  UndefOrNullArgVisitor(const MemRegion *InR) : R(InR) {}
290 
291  void Profile(llvm::FoldingSetNodeID &ID) const override {
292  static int Tag = 0;
293  ID.AddPointer(&Tag);
294  ID.AddPointer(R);
295  }
296 
298  const ExplodedNode *PrevN,
299  BugReporterContext &BRC,
300  BugReport &BR) override;
301 };
302 
304  : public BugReporterVisitorImpl<SuppressInlineDefensiveChecksVisitor> {
305  /// The symbolic value for which we are tracking constraints.
306  /// This value is constrained to null in the end of path.
307  DefinedSVal V;
308 
309  /// Track if we found the node where the constraint was first added.
310  bool IsSatisfied;
311 
312  /// Since the visitors can be registered on nodes previous to the last
313  /// node in the BugReport, but the path traversal always starts with the last
314  /// node, the visitor invariant (that we start with a node in which V is null)
315  /// might not hold when node visitation starts. We are going to start tracking
316  /// from the last node in which the value is null.
317  bool IsTrackingTurnedOn;
318 
319 public:
321 
322  void Profile(llvm::FoldingSetNodeID &ID) const override;
323 
324  /// Return the tag associated with this visitor. This tag will be used
325  /// to make all PathDiagnosticPieces created by this visitor.
326  static const char *getTag();
327 
329  const ExplodedNode *Pred,
330  BugReporterContext &BRC,
331  BugReport &BR) override;
332 };
333 
334 namespace bugreporter {
335 
336 /// Attempts to add visitors to trace a null or undefined value back to its
337 /// point of origin, whether it is a symbol constrained to null or an explicit
338 /// assignment.
339 ///
340 /// \param N A node "downstream" from the evaluation of the statement.
341 /// \param S The statement whose value is null or undefined.
342 /// \param R The bug report to which visitors should be attached.
343 /// \param IsArg Whether the statement is an argument to an inlined function.
344 /// If this is the case, \p N \em must be the CallEnter node for
345 /// the function.
346 /// \param EnableNullFPSuppression Whether we should employ false positive
347 /// suppression (inlined defensive checks, returned null).
348 ///
349 /// \return Whether or not the function was able to add visitors for this
350 /// statement. Note that returning \c true does not actually imply
351 /// that any visitors were added.
352 bool trackNullOrUndefValue(const ExplodedNode *N, const Stmt *S, BugReport &R,
353  bool IsArg = false,
354  bool EnableNullFPSuppression = true);
355 
356 const Expr *getDerefExpr(const Stmt *S);
357 const Stmt *GetDenomExpr(const ExplodedNode *N);
358 const Stmt *GetRetValExpr(const ExplodedNode *N);
359 bool isDeclRefExprToReference(const Expr *E);
360 
361 
362 } // end namespace clang
363 } // end namespace ento
364 } // end namespace bugreporter
365 
366 
367 #endif
const Expr * getDerefExpr(const Stmt *S)
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:79
UndefOrNullArgVisitor(const MemRegion *InR)
PathDiagnosticPiece * VisitNode(const ExplodedNode *N, const ExplodedNode *PrevN, BugReporterContext &BRC, BugReport &BR) override
Return a diagnostic piece which should be associated with the given node.
PathDiagnosticPiece * VisitNode(const ExplodedNode *N, const ExplodedNode *Prev, BugReporterContext &BRC, BugReport &BR) override
Return a diagnostic piece which should be associated with the given node.
virtual void Profile(llvm::FoldingSetNodeID &ID) const =0
TrackConstraintBRVisitor(DefinedSVal constraint, bool assumption)
PathDiagnosticPiece * VisitNode(const ExplodedNode *N, const ExplodedNode *PrevN, BugReporterContext &BRC, BugReport &BR) override
Return a diagnostic piece which should be associated with the given node.
void Profile(llvm::FoldingSetNodeID &ID) const override
PathDiagnosticPiece * VisitNode(const ExplodedNode *N, const ExplodedNode *Prev, BugReporterContext &BRC, BugReport &BR) override
Return a diagnostic piece which should be associated with the given node.
Prints path notes when a message is sent to a nil receiver.
const Stmt * GetDenomExpr(const ExplodedNode *N)
Visitor that tries to report interesting diagnostics from conditions.
void Profile(llvm::FoldingSetNodeID &ID) const override
This class provides a convenience implementation for clone() using the Curiously-Recurring Template P...
bool patternMatch(const Expr *Ex, raw_ostream &Out, BugReporterContext &BRC, BugReport &R, const ExplodedNode *N, Optional< bool > &prunable)
std::unique_ptr< PathDiagnosticPiece > getEndPath(BugReporterContext &BRC, const ExplodedNode *N, BugReport &BR) override
Provide custom definition for the final diagnostic piece on the path - the piece, which is displayed ...
virtual std::unique_ptr< PathDiagnosticPiece > getEndPath(BugReporterContext &BRC, const ExplodedNode *N, BugReport &BR)
Provide custom definition for the final diagnostic piece on the path - the piece, which is displayed ...
void Profile(llvm::FoldingSetNodeID &ID) const override
A builtin binary operation expression such as "x + y" or "x <= y".
Definition: Expr.h:2897
virtual PathDiagnosticPiece * VisitNode(const ExplodedNode *Succ, const ExplodedNode *Pred, BugReporterContext &BRC, BugReport &BR)=0
Return a diagnostic piece which should be associated with the given node.
static void registerStatementVarDecls(BugReport &BR, const Stmt *S, bool EnableNullFPSuppression)
Creates a visitor for every VarDecl inside a Stmt and registers it with the BugReport.
When a region containing undefined value or '0' value is passed as an argument in a call...
void Profile(llvm::FoldingSetNodeID &ID) const override
void Profile(llvm::FoldingSetNodeID &ID) const override
CFGBlock - Represents a single basic block in a source-level CFG.
Definition: CFG.h:353
static const char * getTag()
Return the tag associated with this visitor.
Expr - This represents one expression.
Definition: Expr.h:105
static const Expr * getNilReceiver(const Stmt *S, const ExplodedNode *N)
If the statement is a message send expression with nil receiver, returns the receiver expression...
void Profile(llvm::FoldingSetNodeID &ID) const override
SuppressInlineDefensiveChecksVisitor(DefinedSVal Val, const ExplodedNode *N)
BugReporterVisitors are used to add custom diagnostics along a path.
PathDiagnosticPiece * VisitTerminator(const Stmt *Term, const ExplodedNode *N, const CFGBlock *srcBlk, const CFGBlock *dstBlk, BugReport &R, BugReporterContext &BRC)
static std::unique_ptr< PathDiagnosticPiece > getDefaultEndPath(BugReporterContext &BRC, const ExplodedNode *N, BugReport &BR)
Generates the default final diagnostic piece.
#define false
Definition: stdbool.h:33
void Profile(llvm::FoldingSetNodeID &ID) const override
const std::string ID
PathDiagnosticPiece * VisitNode(const ExplodedNode *N, const ExplodedNode *PrevN, BugReporterContext &BRC, BugReport &BR) override
Return a diagnostic piece which should be associated with the given node.
Suppress reports that might lead to known false positives.
PathDiagnosticPiece * VisitNode(const ExplodedNode *N, const ExplodedNode *PrevN, BugReporterContext &BRC, BugReport &BR) override
Return a diagnostic piece which should be associated with the given node.
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
Definition: SVals.h:46
PathDiagnosticPiece * VisitTrueTest(const Expr *Cond, bool tookTrue, BugReporterContext &BRC, BugReport &R, const ExplodedNode *N)
PathDiagnosticPiece * VisitConditionVariable(StringRef LhsString, const Expr *CondVarExpr, const bool tookTrue, BugReporterContext &BRC, BugReport &R, const ExplodedNode *N)
virtual std::unique_ptr< BugReporterVisitor > clone() const =0
Returns a copy of this BugReporter.
bool isDeclRefExprToReference(const Expr *E)
static const char * getTag()
Return the tag associated with this visitor.
const Stmt * GetRetValExpr(const ExplodedNode *N)
detail::InMemoryDirectory::const_iterator E
Represents an SVal that is guaranteed to not be UnknownVal.
Definition: SVals.h:255
BugReporterVisitor(BugReporterVisitor &&)
PathDiagnosticPiece * VisitNode(const ExplodedNode *Succ, const ExplodedNode *Pred, BugReporterContext &BRC, BugReport &BR) override
Return a diagnostic piece which should be associated with the given node.
bool trackNullOrUndefValue(const ExplodedNode *N, const Stmt *S, BugReport &R, bool IsArg=false, bool EnableNullFPSuppression=true)
Attempts to add visitors to trace a null or undefined value back to its point of origin, whether it is a symbol constrained to null or an explicit assignment.
PathDiagnosticPiece * VisitNodeImpl(const ExplodedNode *N, const ExplodedNode *Prev, BugReporterContext &BRC, BugReport &BR)
A reference to a declared variable, function, enum, etc.
Definition: Expr.h:932
This class provides an interface through which checkers can create individual bug reports...
Definition: BugReporter.h:55
FindLastStoreBRVisitor(KnownSVal V, const MemRegion *R, bool InEnableNullFPSuppression)
static const char * getTag()
Return the tag associated with this visitor.