22 using namespace clang;
27 class UndefBranchChecker :
public Checker<check::BranchCondition> {
28 mutable std::unique_ptr<BuiltinBug> BT;
30 struct FindUndefExpr {
35 : St(std::move(S)), LCtx(L) {}
37 const Expr *FindExpr(
const Expr *Ex) {
38 if (!MatchesCriteria(Ex))
41 for (
const Stmt *SubStmt : Ex->children())
42 if (
const Expr *ExI = dyn_cast_or_null<Expr>(SubStmt))
43 if (
const Expr *E2 = FindExpr(ExI))
49 bool MatchesCriteria(
const Expr *Ex) {
50 return St->getSVal(Ex, LCtx).isUndef();
60 void UndefBranchChecker::checkBranchCondition(
const Stmt *Condition,
70 this,
"Branch condition evaluates to a garbage value"));
87 const Expr *Ex = cast<Expr>(Condition);
93 if (PS->getStmt() == Ex)
94 St = PrevN->getState();
97 Ex = FindIt.FindExpr(Ex);
100 auto R = llvm::make_unique<BugReport>(*BT, BT->getDescription(), N);
102 R->addRange(Ex->getSourceRange());
ExplodedNode * generateErrorNode(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generate a transition to a node that will be used to report an error.
Expr - This represents one expression.
const ProgramStateRef & getState() const
const ProgramStateRef & getState() const
void emitReport(std::unique_ptr< BugReport > R)
Emit the diagnostics report.
CHECKER * registerChecker()
Used to register checkers.
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
Optional< T > getAs() const
Convert to the specified ProgramPoint type, returning None if this ProgramPoint is not of the desired...
X
Add a minimal nested name specifier fixit hint to allow lookup of a tag name from an outer enclosing ...
bool trackNullOrUndefValue(const ExplodedNode *N, const Stmt *S, BugReport &R, bool IsArg=false, bool EnableNullFPSuppression=true)
Attempts to add visitors to trace a null or undefined value back to its point of origin, whether it is a symbol constrained to null or an explicit assignment.
pred_iterator pred_begin()
const LocationContext * getLocationContext() const