1219069Sdim//== CheckerContext.h - Context info for path-sensitive checkers--*- C++ -*--=// 2219069Sdim// 3219069Sdim// The LLVM Compiler Infrastructure 4219069Sdim// 5219069Sdim// This file is distributed under the University of Illinois Open Source 6219069Sdim// License. See LICENSE.TXT for details. 7219069Sdim// 8219069Sdim//===----------------------------------------------------------------------===// 9219069Sdim// 10219069Sdim// This file defines CheckerContext that provides contextual info for 11219069Sdim// path-sensitive checkers. 12219069Sdim// 13219069Sdim//===----------------------------------------------------------------------===// 14219069Sdim 15219069Sdim#ifndef LLVM_CLANG_SA_CORE_PATHSENSITIVE_CHECKERCONTEXT 16219069Sdim#define LLVM_CLANG_SA_CORE_PATHSENSITIVE_CHECKERCONTEXT 17219069Sdim 18219069Sdim#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h" 19245431Sdim#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h" 20219069Sdim 21219069Sdimnamespace clang { 22219069Sdimnamespace ento { 23219069Sdim 24245431Sdim /// Declares an immutable map of type \p NameTy, suitable for placement into 25245431Sdim /// the ProgramState. This is implementing using llvm::ImmutableMap. 26245431Sdim /// 27245431Sdim /// \code 28245431Sdim /// State = State->set<Name>(K, V); 29245431Sdim /// const Value *V = State->get<Name>(K); // Returns NULL if not in the map. 30245431Sdim /// State = State->remove<Name>(K); 31245431Sdim /// NameTy Map = State->get<Name>(); 32245431Sdim /// \endcode 33245431Sdim /// 34245431Sdim /// The macro should not be used inside namespaces, or for traits that must 35245431Sdim /// be accessible from more than one translation unit. 36245431Sdim #define REGISTER_MAP_WITH_PROGRAMSTATE(Name, Key, Value) \ 37245431Sdim REGISTER_TRAIT_WITH_PROGRAMSTATE(Name, \ 38245431Sdim CLANG_ENTO_PROGRAMSTATE_MAP(Key, Value)) 39245431Sdim 40245431Sdim /// Declares an immutable set of type \p NameTy, suitable for placement into 41245431Sdim /// the ProgramState. This is implementing using llvm::ImmutableSet. 42245431Sdim /// 43245431Sdim /// \code 44245431Sdim /// State = State->add<Name>(E); 45245431Sdim /// State = State->remove<Name>(E); 46245431Sdim /// bool Present = State->contains<Name>(E); 47245431Sdim /// NameTy Set = State->get<Name>(); 48245431Sdim /// \endcode 49245431Sdim /// 50245431Sdim /// The macro should not be used inside namespaces, or for traits that must 51245431Sdim /// be accessible from more than one translation unit. 52245431Sdim #define REGISTER_SET_WITH_PROGRAMSTATE(Name, Elem) \ 53245431Sdim REGISTER_TRAIT_WITH_PROGRAMSTATE(Name, llvm::ImmutableSet<Elem>) 54245431Sdim 55245431Sdim /// Declares an immutable list of type \p NameTy, suitable for placement into 56245431Sdim /// the ProgramState. This is implementing using llvm::ImmutableList. 57245431Sdim /// 58245431Sdim /// \code 59245431Sdim /// State = State->add<Name>(E); // Adds to the /end/ of the list. 60245431Sdim /// bool Present = State->contains<Name>(E); 61245431Sdim /// NameTy List = State->get<Name>(); 62245431Sdim /// \endcode 63245431Sdim /// 64245431Sdim /// The macro should not be used inside namespaces, or for traits that must 65245431Sdim /// be accessible from more than one translation unit. 66245431Sdim #define REGISTER_LIST_WITH_PROGRAMSTATE(Name, Elem) \ 67245431Sdim REGISTER_TRAIT_WITH_PROGRAMSTATE(Name, llvm::ImmutableList<Elem>) 68245431Sdim 69245431Sdim 70219069Sdimclass CheckerContext { 71219069Sdim ExprEngine &Eng; 72235633Sdim /// The current exploded(symbolic execution) graph node. 73219069Sdim ExplodedNode *Pred; 74235633Sdim /// The flag is true if the (state of the execution) has been modified 75235633Sdim /// by the checker using this context. For example, a new transition has been 76235633Sdim /// added or a bug report issued. 77235633Sdim bool Changed; 78235633Sdim /// The tagged location, which is used to generate all new nodes. 79226890Sdim const ProgramPoint Location; 80235633Sdim NodeBuilder &NB; 81235633Sdim 82219069Sdimpublic: 83235633Sdim /// If we are post visiting a call, this flag will be set if the 84235633Sdim /// call was inlined. In all other cases it will be false. 85235633Sdim const bool wasInlined; 86235633Sdim 87235633Sdim CheckerContext(NodeBuilder &builder, 88226890Sdim ExprEngine &eng, 89226890Sdim ExplodedNode *pred, 90226890Sdim const ProgramPoint &loc, 91235633Sdim bool wasInlined = false) 92235633Sdim : Eng(eng), 93226890Sdim Pred(pred), 94235633Sdim Changed(false), 95226890Sdim Location(loc), 96235633Sdim NB(builder), 97235633Sdim wasInlined(wasInlined) { 98235633Sdim assert(Pred->getState() && 99235633Sdim "We should not call the checkers on an empty state."); 100219069Sdim } 101219069Sdim 102219069Sdim AnalysisManager &getAnalysisManager() { 103219069Sdim return Eng.getAnalysisManager(); 104219069Sdim } 105219069Sdim 106219069Sdim ConstraintManager &getConstraintManager() { 107219069Sdim return Eng.getConstraintManager(); 108219069Sdim } 109219069Sdim 110219069Sdim StoreManager &getStoreManager() { 111219069Sdim return Eng.getStoreManager(); 112219069Sdim } 113245431Sdim 114235633Sdim /// \brief Returns the previous node in the exploded graph, which includes 115235633Sdim /// the state of the program before the checker ran. Note, checkers should 116235633Sdim /// not retain the node in their state since the nodes might get invalidated. 117235633Sdim ExplodedNode *getPredecessor() { return Pred; } 118252723Sdim const ProgramStateRef &getState() const { return Pred->getState(); } 119219069Sdim 120235633Sdim /// \brief Check if the checker changed the state of the execution; ex: added 121235633Sdim /// a new transition or a bug report. 122235633Sdim bool isDifferent() { return Changed; } 123235633Sdim 124226890Sdim /// \brief Returns the number of times the current block has been visited 125226890Sdim /// along the analyzed path. 126245431Sdim unsigned blockCount() const { 127245431Sdim return NB.getContext().blockCount(); 128235633Sdim } 129226890Sdim 130219069Sdim ASTContext &getASTContext() { 131219069Sdim return Eng.getContext(); 132219069Sdim } 133235633Sdim 134235633Sdim const LangOptions &getLangOpts() const { 135235633Sdim return Eng.getContext().getLangOpts(); 136235633Sdim } 137235633Sdim 138235633Sdim const LocationContext *getLocationContext() const { 139235633Sdim return Pred->getLocationContext(); 140235633Sdim } 141235633Sdim 142245431Sdim const StackFrameContext *getStackFrame() const { 143245431Sdim return Pred->getStackFrame(); 144245431Sdim } 145245431Sdim 146245431Sdim /// Return true if the current LocationContext has no caller context. 147245431Sdim bool inTopFrame() const { return getLocationContext()->inTopFrame(); } 148245431Sdim 149219069Sdim BugReporter &getBugReporter() { 150219069Sdim return Eng.getBugReporter(); 151219069Sdim } 152219069Sdim 153219069Sdim SourceManager &getSourceManager() { 154219069Sdim return getBugReporter().getSourceManager(); 155219069Sdim } 156219069Sdim 157219069Sdim SValBuilder &getSValBuilder() { 158219069Sdim return Eng.getSValBuilder(); 159219069Sdim } 160219069Sdim 161226890Sdim SymbolManager &getSymbolManager() { 162226890Sdim return getSValBuilder().getSymbolManager(); 163226890Sdim } 164226890Sdim 165235633Sdim bool isObjCGCEnabled() const { 166226890Sdim return Eng.isObjCGCEnabled(); 167226890Sdim } 168226890Sdim 169235633Sdim ProgramStateManager &getStateManager() { 170235633Sdim return Eng.getStateManager(); 171219069Sdim } 172235633Sdim 173235633Sdim AnalysisDeclContext *getCurrentAnalysisDeclContext() const { 174235633Sdim return Pred->getLocationContext()->getAnalysisDeclContext(); 175219069Sdim } 176219069Sdim 177235633Sdim /// \brief If the given node corresponds to a PostStore program point, retrieve 178235633Sdim /// the location region as it was uttered in the code. 179235633Sdim /// 180235633Sdim /// This utility can be useful for generating extensive diagnostics, for 181235633Sdim /// example, for finding variables that the given symbol was assigned to. 182235633Sdim static const MemRegion *getLocationRegionIfPostStore(const ExplodedNode *N) { 183235633Sdim ProgramPoint L = N->getLocation(); 184252723Sdim if (Optional<PostStore> PSL = L.getAs<PostStore>()) 185235633Sdim return reinterpret_cast<const MemRegion*>(PSL->getLocationValue()); 186235633Sdim return 0; 187219069Sdim } 188219069Sdim 189245431Sdim /// \brief Get the value of arbitrary expressions at this point in the path. 190245431Sdim SVal getSVal(const Stmt *S) const { 191245431Sdim return getState()->getSVal(S, getLocationContext()); 192245431Sdim } 193245431Sdim 194235633Sdim /// \brief Generates a new transition in the program state graph 195235633Sdim /// (ExplodedGraph). Uses the default CheckerContext predecessor node. 196235633Sdim /// 197245431Sdim /// @param State The state of the generated node. If not specified, the state 198245431Sdim /// will not be changed, but the new node will have the checker's tag. 199235633Sdim /// @param Tag The tag is used to uniquely identify the creation site. If no 200235633Sdim /// tag is specified, a default tag, unique to the given checker, 201235633Sdim /// will be used. Tags are used to prevent states generated at 202235633Sdim /// different sites from caching out. 203245431Sdim ExplodedNode *addTransition(ProgramStateRef State = 0, 204235633Sdim const ProgramPointTag *Tag = 0) { 205245431Sdim return addTransitionImpl(State ? State : getState(), false, 0, Tag); 206219069Sdim } 207219069Sdim 208235633Sdim /// \brief Generates a new transition with the given predecessor. 209235633Sdim /// Allows checkers to generate a chain of nodes. 210235633Sdim /// 211235633Sdim /// @param State The state of the generated node. 212235633Sdim /// @param Pred The transition will be generated from the specified Pred node 213235633Sdim /// to the newly generated node. 214235633Sdim /// @param Tag The tag to uniquely identify the creation site. 215235633Sdim ExplodedNode *addTransition(ProgramStateRef State, 216245431Sdim ExplodedNode *Pred, 217245431Sdim const ProgramPointTag *Tag = 0) { 218245431Sdim return addTransitionImpl(State, false, Pred, Tag); 219219069Sdim } 220219069Sdim 221245431Sdim /// \brief Generate a sink node. Generating a sink stops exploration of the 222235633Sdim /// given path. 223245431Sdim ExplodedNode *generateSink(ProgramStateRef State = 0, 224245431Sdim ExplodedNode *Pred = 0, 225245431Sdim const ProgramPointTag *Tag = 0) { 226245431Sdim return addTransitionImpl(State ? State : getState(), true, Pred, Tag); 227235633Sdim } 228235633Sdim 229235633Sdim /// \brief Emit the diagnostics report. 230245431Sdim void emitReport(BugReport *R) { 231235633Sdim Changed = true; 232245431Sdim Eng.getBugReporter().emitReport(R); 233219069Sdim } 234219069Sdim 235235633Sdim /// \brief Get the declaration of the called function (path-sensitive). 236235633Sdim const FunctionDecl *getCalleeDecl(const CallExpr *CE) const; 237235633Sdim 238235633Sdim /// \brief Get the name of the called function (path-sensitive). 239235633Sdim StringRef getCalleeName(const FunctionDecl *FunDecl) const; 240235633Sdim 241245431Sdim /// \brief Get the identifier of the called function (path-sensitive). 242245431Sdim const IdentifierInfo *getCalleeIdentifier(const CallExpr *CE) const { 243245431Sdim const FunctionDecl *FunDecl = getCalleeDecl(CE); 244245431Sdim if (FunDecl) 245245431Sdim return FunDecl->getIdentifier(); 246245431Sdim else 247245431Sdim return 0; 248245431Sdim } 249245431Sdim 250235633Sdim /// \brief Get the name of the called function (path-sensitive). 251235633Sdim StringRef getCalleeName(const CallExpr *CE) const { 252235633Sdim const FunctionDecl *FunDecl = getCalleeDecl(CE); 253235633Sdim return getCalleeName(FunDecl); 254219069Sdim } 255219069Sdim 256245431Sdim /// \brief Returns true if the callee is an externally-visible function in the 257245431Sdim /// top-level namespace, such as \c malloc. 258245431Sdim /// 259245431Sdim /// If a name is provided, the function must additionally match the given 260245431Sdim /// name. 261245431Sdim /// 262245431Sdim /// Note that this deliberately excludes C++ library functions in the \c std 263245431Sdim /// namespace, but will include C library functions accessed through the 264245431Sdim /// \c std namespace. This also does not check if the function is declared 265245431Sdim /// as 'extern "C"', or if it uses C++ name mangling. 266245431Sdim static bool isCLibraryFunction(const FunctionDecl *FD, 267245431Sdim StringRef Name = StringRef()); 268235633Sdim 269235633Sdim /// \brief Depending on wither the location corresponds to a macro, return 270235633Sdim /// either the macro name or the token spelling. 271235633Sdim /// 272235633Sdim /// This could be useful when checkers' logic depends on whether a function 273235633Sdim /// is called with a given macro argument. For example: 274235633Sdim /// s = socket(AF_INET,..) 275235633Sdim /// If AF_INET is a macro, the result should be treated as a source of taint. 276235633Sdim /// 277235633Sdim /// \sa clang::Lexer::getSpelling(), clang::Lexer::getImmediateMacroName(). 278235633Sdim StringRef getMacroNameOrSpelling(SourceLocation &Loc); 279235633Sdim 280219069Sdimprivate: 281235633Sdim ExplodedNode *addTransitionImpl(ProgramStateRef State, 282235633Sdim bool MarkAsSink, 283235633Sdim ExplodedNode *P = 0, 284235633Sdim const ProgramPointTag *Tag = 0) { 285235633Sdim if (!State || (State == Pred->getState() && !Tag && !MarkAsSink)) 286235633Sdim return Pred; 287219069Sdim 288235633Sdim Changed = true; 289245431Sdim const ProgramPoint &LocalLoc = (Tag ? Location.withTag(Tag) : Location); 290245431Sdim if (!P) 291245431Sdim P = Pred; 292245431Sdim 293245431Sdim ExplodedNode *node; 294245431Sdim if (MarkAsSink) 295245431Sdim node = NB.generateSink(LocalLoc, State, P); 296245431Sdim else 297245431Sdim node = NB.generateNode(LocalLoc, State, P); 298219069Sdim return node; 299219069Sdim } 300219069Sdim}; 301219069Sdim 302219069Sdim} // end GR namespace 303219069Sdim 304219069Sdim} // end clang namespace 305219069Sdim 306219069Sdim#endif 307