CheckerManager.cpp 29 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772
  1. //===--- CheckerManager.cpp - Static Analyzer Checker Manager -------------===//
  2. //
  3. // The LLVM Compiler Infrastructure
  4. //
  5. // This file is distributed under the University of Illinois Open Source
  6. // License. See LICENSE.TXT for details.
  7. //
  8. //===----------------------------------------------------------------------===//
  9. //
  10. // Defines the Static Analyzer Checker Manager.
  11. //
  12. //===----------------------------------------------------------------------===//
  13. #include "clang/StaticAnalyzer/Core/CheckerManager.h"
  14. #include "clang/AST/DeclBase.h"
  15. #include "clang/Analysis/ProgramPoint.h"
  16. #include "clang/StaticAnalyzer/Core/Checker.h"
  17. #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
  18. #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
  19. using namespace clang;
  20. using namespace ento;
  21. bool CheckerManager::hasPathSensitiveCheckers() const {
  22. return !StmtCheckers.empty() ||
  23. !PreObjCMessageCheckers.empty() ||
  24. !PostObjCMessageCheckers.empty() ||
  25. !PreCallCheckers.empty() ||
  26. !PostCallCheckers.empty() ||
  27. !LocationCheckers.empty() ||
  28. !BindCheckers.empty() ||
  29. !EndAnalysisCheckers.empty() ||
  30. !EndFunctionCheckers.empty() ||
  31. !BranchConditionCheckers.empty() ||
  32. !LiveSymbolsCheckers.empty() ||
  33. !DeadSymbolsCheckers.empty() ||
  34. !RegionChangesCheckers.empty() ||
  35. !EvalAssumeCheckers.empty() ||
  36. !EvalCallCheckers.empty();
  37. }
  38. void CheckerManager::finishedCheckerRegistration() {
  39. #ifndef NDEBUG
  40. // Make sure that for every event that has listeners, there is at least
  41. // one dispatcher registered for it.
  42. for (llvm::DenseMap<EventTag, EventInfo>::iterator
  43. I = Events.begin(), E = Events.end(); I != E; ++I)
  44. assert(I->second.HasDispatcher && "No dispatcher registered for an event");
  45. #endif
  46. }
  47. //===----------------------------------------------------------------------===//
  48. // Functions for running checkers for AST traversing..
  49. //===----------------------------------------------------------------------===//
  50. void CheckerManager::runCheckersOnASTDecl(const Decl *D, AnalysisManager& mgr,
  51. BugReporter &BR) {
  52. assert(D);
  53. unsigned DeclKind = D->getKind();
  54. CachedDeclCheckers *checkers = nullptr;
  55. CachedDeclCheckersMapTy::iterator CCI = CachedDeclCheckersMap.find(DeclKind);
  56. if (CCI != CachedDeclCheckersMap.end()) {
  57. checkers = &(CCI->second);
  58. } else {
  59. // Find the checkers that should run for this Decl and cache them.
  60. checkers = &CachedDeclCheckersMap[DeclKind];
  61. for (unsigned i = 0, e = DeclCheckers.size(); i != e; ++i) {
  62. DeclCheckerInfo &info = DeclCheckers[i];
  63. if (info.IsForDeclFn(D))
  64. checkers->push_back(info.CheckFn);
  65. }
  66. }
  67. assert(checkers);
  68. for (CachedDeclCheckers::iterator
  69. I = checkers->begin(), E = checkers->end(); I != E; ++I)
  70. (*I)(D, mgr, BR);
  71. }
  72. void CheckerManager::runCheckersOnASTBody(const Decl *D, AnalysisManager& mgr,
  73. BugReporter &BR) {
  74. assert(D && D->hasBody());
  75. for (unsigned i = 0, e = BodyCheckers.size(); i != e; ++i)
  76. BodyCheckers[i](D, mgr, BR);
  77. }
  78. //===----------------------------------------------------------------------===//
  79. // Functions for running checkers for path-sensitive checking.
  80. //===----------------------------------------------------------------------===//
  81. template <typename CHECK_CTX>
  82. static void expandGraphWithCheckers(CHECK_CTX checkCtx,
  83. ExplodedNodeSet &Dst,
  84. const ExplodedNodeSet &Src) {
  85. const NodeBuilderContext &BldrCtx = checkCtx.Eng.getBuilderContext();
  86. if (Src.empty())
  87. return;
  88. typename CHECK_CTX::CheckersTy::const_iterator
  89. I = checkCtx.checkers_begin(), E = checkCtx.checkers_end();
  90. if (I == E) {
  91. Dst.insert(Src);
  92. return;
  93. }
  94. ExplodedNodeSet Tmp1, Tmp2;
  95. const ExplodedNodeSet *PrevSet = &Src;
  96. for (; I != E; ++I) {
  97. ExplodedNodeSet *CurrSet = nullptr;
  98. if (I+1 == E)
  99. CurrSet = &Dst;
  100. else {
  101. CurrSet = (PrevSet == &Tmp1) ? &Tmp2 : &Tmp1;
  102. CurrSet->clear();
  103. }
  104. NodeBuilder B(*PrevSet, *CurrSet, BldrCtx);
  105. for (ExplodedNodeSet::iterator NI = PrevSet->begin(), NE = PrevSet->end();
  106. NI != NE; ++NI) {
  107. checkCtx.runChecker(*I, B, *NI);
  108. }
  109. // If all the produced transitions are sinks, stop.
  110. if (CurrSet->empty())
  111. return;
  112. // Update which NodeSet is the current one.
  113. PrevSet = CurrSet;
  114. }
  115. }
  116. namespace {
  117. struct CheckStmtContext {
  118. typedef SmallVectorImpl<CheckerManager::CheckStmtFunc> CheckersTy;
  119. bool IsPreVisit;
  120. const CheckersTy &Checkers;
  121. const Stmt *S;
  122. ExprEngine &Eng;
  123. bool WasInlined;
  124. CheckersTy::const_iterator checkers_begin() { return Checkers.begin(); }
  125. CheckersTy::const_iterator checkers_end() { return Checkers.end(); }
  126. CheckStmtContext(bool isPreVisit, const CheckersTy &checkers,
  127. const Stmt *s, ExprEngine &eng, bool wasInlined = false)
  128. : IsPreVisit(isPreVisit), Checkers(checkers), S(s), Eng(eng),
  129. WasInlined(wasInlined) {}
  130. void runChecker(CheckerManager::CheckStmtFunc checkFn,
  131. NodeBuilder &Bldr, ExplodedNode *Pred) {
  132. // FIXME: Remove respondsToCallback from CheckerContext;
  133. ProgramPoint::Kind K = IsPreVisit ? ProgramPoint::PreStmtKind :
  134. ProgramPoint::PostStmtKind;
  135. const ProgramPoint &L = ProgramPoint::getProgramPoint(S, K,
  136. Pred->getLocationContext(), checkFn.Checker);
  137. CheckerContext C(Bldr, Eng, Pred, L, WasInlined);
  138. checkFn(S, C);
  139. }
  140. };
  141. }
  142. /// \brief Run checkers for visiting Stmts.
  143. void CheckerManager::runCheckersForStmt(bool isPreVisit,
  144. ExplodedNodeSet &Dst,
  145. const ExplodedNodeSet &Src,
  146. const Stmt *S,
  147. ExprEngine &Eng,
  148. bool WasInlined) {
  149. CheckStmtContext C(isPreVisit, getCachedStmtCheckersFor(S, isPreVisit),
  150. S, Eng, WasInlined);
  151. expandGraphWithCheckers(C, Dst, Src);
  152. }
  153. namespace {
  154. struct CheckObjCMessageContext {
  155. typedef std::vector<CheckerManager::CheckObjCMessageFunc> CheckersTy;
  156. ObjCMessageVisitKind Kind;
  157. bool WasInlined;
  158. const CheckersTy &Checkers;
  159. const ObjCMethodCall &Msg;
  160. ExprEngine &Eng;
  161. CheckersTy::const_iterator checkers_begin() { return Checkers.begin(); }
  162. CheckersTy::const_iterator checkers_end() { return Checkers.end(); }
  163. CheckObjCMessageContext(ObjCMessageVisitKind visitKind,
  164. const CheckersTy &checkers,
  165. const ObjCMethodCall &msg, ExprEngine &eng,
  166. bool wasInlined)
  167. : Kind(visitKind), WasInlined(wasInlined), Checkers(checkers),
  168. Msg(msg), Eng(eng) { }
  169. void runChecker(CheckerManager::CheckObjCMessageFunc checkFn,
  170. NodeBuilder &Bldr, ExplodedNode *Pred) {
  171. bool IsPreVisit;
  172. switch (Kind) {
  173. case ObjCMessageVisitKind::Pre:
  174. IsPreVisit = true;
  175. break;
  176. case ObjCMessageVisitKind::MessageNil:
  177. case ObjCMessageVisitKind::Post:
  178. IsPreVisit = false;
  179. break;
  180. }
  181. const ProgramPoint &L = Msg.getProgramPoint(IsPreVisit,checkFn.Checker);
  182. CheckerContext C(Bldr, Eng, Pred, L, WasInlined);
  183. checkFn(*Msg.cloneWithState<ObjCMethodCall>(Pred->getState()), C);
  184. }
  185. };
  186. }
  187. /// \brief Run checkers for visiting obj-c messages.
  188. void CheckerManager::runCheckersForObjCMessage(ObjCMessageVisitKind visitKind,
  189. ExplodedNodeSet &Dst,
  190. const ExplodedNodeSet &Src,
  191. const ObjCMethodCall &msg,
  192. ExprEngine &Eng,
  193. bool WasInlined) {
  194. auto &checkers = getObjCMessageCheckers(visitKind);
  195. CheckObjCMessageContext C(visitKind, checkers, msg, Eng, WasInlined);
  196. expandGraphWithCheckers(C, Dst, Src);
  197. }
  198. const std::vector<CheckerManager::CheckObjCMessageFunc> &
  199. CheckerManager::getObjCMessageCheckers(ObjCMessageVisitKind Kind) {
  200. switch (Kind) {
  201. case ObjCMessageVisitKind::Pre:
  202. return PreObjCMessageCheckers;
  203. break;
  204. case ObjCMessageVisitKind::Post:
  205. return PostObjCMessageCheckers;
  206. case ObjCMessageVisitKind::MessageNil:
  207. return ObjCMessageNilCheckers;
  208. }
  209. llvm_unreachable("Unknown Kind");
  210. }
  211. namespace {
  212. // FIXME: This has all the same signatures as CheckObjCMessageContext.
  213. // Is there a way we can merge the two?
  214. struct CheckCallContext {
  215. typedef std::vector<CheckerManager::CheckCallFunc> CheckersTy;
  216. bool IsPreVisit, WasInlined;
  217. const CheckersTy &Checkers;
  218. const CallEvent &Call;
  219. ExprEngine &Eng;
  220. CheckersTy::const_iterator checkers_begin() { return Checkers.begin(); }
  221. CheckersTy::const_iterator checkers_end() { return Checkers.end(); }
  222. CheckCallContext(bool isPreVisit, const CheckersTy &checkers,
  223. const CallEvent &call, ExprEngine &eng,
  224. bool wasInlined)
  225. : IsPreVisit(isPreVisit), WasInlined(wasInlined), Checkers(checkers),
  226. Call(call), Eng(eng) { }
  227. void runChecker(CheckerManager::CheckCallFunc checkFn,
  228. NodeBuilder &Bldr, ExplodedNode *Pred) {
  229. const ProgramPoint &L = Call.getProgramPoint(IsPreVisit,checkFn.Checker);
  230. CheckerContext C(Bldr, Eng, Pred, L, WasInlined);
  231. checkFn(*Call.cloneWithState(Pred->getState()), C);
  232. }
  233. };
  234. }
  235. /// \brief Run checkers for visiting an abstract call event.
  236. void CheckerManager::runCheckersForCallEvent(bool isPreVisit,
  237. ExplodedNodeSet &Dst,
  238. const ExplodedNodeSet &Src,
  239. const CallEvent &Call,
  240. ExprEngine &Eng,
  241. bool WasInlined) {
  242. CheckCallContext C(isPreVisit,
  243. isPreVisit ? PreCallCheckers
  244. : PostCallCheckers,
  245. Call, Eng, WasInlined);
  246. expandGraphWithCheckers(C, Dst, Src);
  247. }
  248. namespace {
  249. struct CheckLocationContext {
  250. typedef std::vector<CheckerManager::CheckLocationFunc> CheckersTy;
  251. const CheckersTy &Checkers;
  252. SVal Loc;
  253. bool IsLoad;
  254. const Stmt *NodeEx; /* Will become a CFGStmt */
  255. const Stmt *BoundEx;
  256. ExprEngine &Eng;
  257. CheckersTy::const_iterator checkers_begin() { return Checkers.begin(); }
  258. CheckersTy::const_iterator checkers_end() { return Checkers.end(); }
  259. CheckLocationContext(const CheckersTy &checkers,
  260. SVal loc, bool isLoad, const Stmt *NodeEx,
  261. const Stmt *BoundEx,
  262. ExprEngine &eng)
  263. : Checkers(checkers), Loc(loc), IsLoad(isLoad), NodeEx(NodeEx),
  264. BoundEx(BoundEx), Eng(eng) {}
  265. void runChecker(CheckerManager::CheckLocationFunc checkFn,
  266. NodeBuilder &Bldr, ExplodedNode *Pred) {
  267. ProgramPoint::Kind K = IsLoad ? ProgramPoint::PreLoadKind :
  268. ProgramPoint::PreStoreKind;
  269. const ProgramPoint &L =
  270. ProgramPoint::getProgramPoint(NodeEx, K,
  271. Pred->getLocationContext(),
  272. checkFn.Checker);
  273. CheckerContext C(Bldr, Eng, Pred, L);
  274. checkFn(Loc, IsLoad, BoundEx, C);
  275. }
  276. };
  277. }
  278. /// \brief Run checkers for load/store of a location.
  279. void CheckerManager::runCheckersForLocation(ExplodedNodeSet &Dst,
  280. const ExplodedNodeSet &Src,
  281. SVal location, bool isLoad,
  282. const Stmt *NodeEx,
  283. const Stmt *BoundEx,
  284. ExprEngine &Eng) {
  285. CheckLocationContext C(LocationCheckers, location, isLoad, NodeEx,
  286. BoundEx, Eng);
  287. expandGraphWithCheckers(C, Dst, Src);
  288. }
  289. namespace {
  290. struct CheckBindContext {
  291. typedef std::vector<CheckerManager::CheckBindFunc> CheckersTy;
  292. const CheckersTy &Checkers;
  293. SVal Loc;
  294. SVal Val;
  295. const Stmt *S;
  296. ExprEngine &Eng;
  297. const ProgramPoint &PP;
  298. CheckersTy::const_iterator checkers_begin() { return Checkers.begin(); }
  299. CheckersTy::const_iterator checkers_end() { return Checkers.end(); }
  300. CheckBindContext(const CheckersTy &checkers,
  301. SVal loc, SVal val, const Stmt *s, ExprEngine &eng,
  302. const ProgramPoint &pp)
  303. : Checkers(checkers), Loc(loc), Val(val), S(s), Eng(eng), PP(pp) {}
  304. void runChecker(CheckerManager::CheckBindFunc checkFn,
  305. NodeBuilder &Bldr, ExplodedNode *Pred) {
  306. const ProgramPoint &L = PP.withTag(checkFn.Checker);
  307. CheckerContext C(Bldr, Eng, Pred, L);
  308. checkFn(Loc, Val, S, C);
  309. }
  310. };
  311. }
  312. /// \brief Run checkers for binding of a value to a location.
  313. void CheckerManager::runCheckersForBind(ExplodedNodeSet &Dst,
  314. const ExplodedNodeSet &Src,
  315. SVal location, SVal val,
  316. const Stmt *S, ExprEngine &Eng,
  317. const ProgramPoint &PP) {
  318. CheckBindContext C(BindCheckers, location, val, S, Eng, PP);
  319. expandGraphWithCheckers(C, Dst, Src);
  320. }
  321. void CheckerManager::runCheckersForEndAnalysis(ExplodedGraph &G,
  322. BugReporter &BR,
  323. ExprEngine &Eng) {
  324. for (unsigned i = 0, e = EndAnalysisCheckers.size(); i != e; ++i)
  325. EndAnalysisCheckers[i](G, BR, Eng);
  326. }
  327. namespace {
  328. struct CheckBeginFunctionContext {
  329. typedef std::vector<CheckerManager::CheckBeginFunctionFunc> CheckersTy;
  330. const CheckersTy &Checkers;
  331. ExprEngine &Eng;
  332. const ProgramPoint &PP;
  333. CheckersTy::const_iterator checkers_begin() { return Checkers.begin(); }
  334. CheckersTy::const_iterator checkers_end() { return Checkers.end(); }
  335. CheckBeginFunctionContext(const CheckersTy &Checkers, ExprEngine &Eng,
  336. const ProgramPoint &PP)
  337. : Checkers(Checkers), Eng(Eng), PP(PP) {}
  338. void runChecker(CheckerManager::CheckBeginFunctionFunc checkFn,
  339. NodeBuilder &Bldr, ExplodedNode *Pred) {
  340. const ProgramPoint &L = PP.withTag(checkFn.Checker);
  341. CheckerContext C(Bldr, Eng, Pred, L);
  342. checkFn(C);
  343. }
  344. };
  345. }
  346. void CheckerManager::runCheckersForBeginFunction(ExplodedNodeSet &Dst,
  347. const BlockEdge &L,
  348. ExplodedNode *Pred,
  349. ExprEngine &Eng) {
  350. ExplodedNodeSet Src;
  351. Src.insert(Pred);
  352. CheckBeginFunctionContext C(BeginFunctionCheckers, Eng, L);
  353. expandGraphWithCheckers(C, Dst, Src);
  354. }
  355. /// \brief Run checkers for end of path.
  356. // Note, We do not chain the checker output (like in expandGraphWithCheckers)
  357. // for this callback since end of path nodes are expected to be final.
  358. void CheckerManager::runCheckersForEndFunction(NodeBuilderContext &BC,
  359. ExplodedNodeSet &Dst,
  360. ExplodedNode *Pred,
  361. ExprEngine &Eng) {
  362. // We define the builder outside of the loop bacause if at least one checkers
  363. // creates a sucsessor for Pred, we do not need to generate an
  364. // autotransition for it.
  365. NodeBuilder Bldr(Pred, Dst, BC);
  366. for (unsigned i = 0, e = EndFunctionCheckers.size(); i != e; ++i) {
  367. CheckEndFunctionFunc checkFn = EndFunctionCheckers[i];
  368. const ProgramPoint &L = BlockEntrance(BC.Block,
  369. Pred->getLocationContext(),
  370. checkFn.Checker);
  371. CheckerContext C(Bldr, Eng, Pred, L);
  372. checkFn(C);
  373. }
  374. }
  375. namespace {
  376. struct CheckBranchConditionContext {
  377. typedef std::vector<CheckerManager::CheckBranchConditionFunc> CheckersTy;
  378. const CheckersTy &Checkers;
  379. const Stmt *Condition;
  380. ExprEngine &Eng;
  381. CheckersTy::const_iterator checkers_begin() { return Checkers.begin(); }
  382. CheckersTy::const_iterator checkers_end() { return Checkers.end(); }
  383. CheckBranchConditionContext(const CheckersTy &checkers,
  384. const Stmt *Cond, ExprEngine &eng)
  385. : Checkers(checkers), Condition(Cond), Eng(eng) {}
  386. void runChecker(CheckerManager::CheckBranchConditionFunc checkFn,
  387. NodeBuilder &Bldr, ExplodedNode *Pred) {
  388. ProgramPoint L = PostCondition(Condition, Pred->getLocationContext(),
  389. checkFn.Checker);
  390. CheckerContext C(Bldr, Eng, Pred, L);
  391. checkFn(Condition, C);
  392. }
  393. };
  394. }
  395. /// \brief Run checkers for branch condition.
  396. void CheckerManager::runCheckersForBranchCondition(const Stmt *Condition,
  397. ExplodedNodeSet &Dst,
  398. ExplodedNode *Pred,
  399. ExprEngine &Eng) {
  400. ExplodedNodeSet Src;
  401. Src.insert(Pred);
  402. CheckBranchConditionContext C(BranchConditionCheckers, Condition, Eng);
  403. expandGraphWithCheckers(C, Dst, Src);
  404. }
  405. /// \brief Run checkers for live symbols.
  406. void CheckerManager::runCheckersForLiveSymbols(ProgramStateRef state,
  407. SymbolReaper &SymReaper) {
  408. for (unsigned i = 0, e = LiveSymbolsCheckers.size(); i != e; ++i)
  409. LiveSymbolsCheckers[i](state, SymReaper);
  410. }
  411. namespace {
  412. struct CheckDeadSymbolsContext {
  413. typedef std::vector<CheckerManager::CheckDeadSymbolsFunc> CheckersTy;
  414. const CheckersTy &Checkers;
  415. SymbolReaper &SR;
  416. const Stmt *S;
  417. ExprEngine &Eng;
  418. ProgramPoint::Kind ProgarmPointKind;
  419. CheckersTy::const_iterator checkers_begin() { return Checkers.begin(); }
  420. CheckersTy::const_iterator checkers_end() { return Checkers.end(); }
  421. CheckDeadSymbolsContext(const CheckersTy &checkers, SymbolReaper &sr,
  422. const Stmt *s, ExprEngine &eng,
  423. ProgramPoint::Kind K)
  424. : Checkers(checkers), SR(sr), S(s), Eng(eng), ProgarmPointKind(K) { }
  425. void runChecker(CheckerManager::CheckDeadSymbolsFunc checkFn,
  426. NodeBuilder &Bldr, ExplodedNode *Pred) {
  427. const ProgramPoint &L = ProgramPoint::getProgramPoint(S, ProgarmPointKind,
  428. Pred->getLocationContext(), checkFn.Checker);
  429. CheckerContext C(Bldr, Eng, Pred, L);
  430. // Note, do not pass the statement to the checkers without letting them
  431. // differentiate if we ran remove dead bindings before or after the
  432. // statement.
  433. checkFn(SR, C);
  434. }
  435. };
  436. }
  437. /// \brief Run checkers for dead symbols.
  438. void CheckerManager::runCheckersForDeadSymbols(ExplodedNodeSet &Dst,
  439. const ExplodedNodeSet &Src,
  440. SymbolReaper &SymReaper,
  441. const Stmt *S,
  442. ExprEngine &Eng,
  443. ProgramPoint::Kind K) {
  444. CheckDeadSymbolsContext C(DeadSymbolsCheckers, SymReaper, S, Eng, K);
  445. expandGraphWithCheckers(C, Dst, Src);
  446. }
  447. /// \brief Run checkers for region changes.
  448. ProgramStateRef
  449. CheckerManager::runCheckersForRegionChanges(ProgramStateRef state,
  450. const InvalidatedSymbols *invalidated,
  451. ArrayRef<const MemRegion *> ExplicitRegions,
  452. ArrayRef<const MemRegion *> Regions,
  453. const CallEvent *Call) {
  454. for (unsigned i = 0, e = RegionChangesCheckers.size(); i != e; ++i) {
  455. // If any checker declares the state infeasible (or if it starts that way),
  456. // bail out.
  457. if (!state)
  458. return nullptr;
  459. state = RegionChangesCheckers[i](state, invalidated,
  460. ExplicitRegions, Regions, Call);
  461. }
  462. return state;
  463. }
  464. /// \brief Run checkers to process symbol escape event.
  465. ProgramStateRef
  466. CheckerManager::runCheckersForPointerEscape(ProgramStateRef State,
  467. const InvalidatedSymbols &Escaped,
  468. const CallEvent *Call,
  469. PointerEscapeKind Kind,
  470. RegionAndSymbolInvalidationTraits *ETraits) {
  471. assert((Call != nullptr ||
  472. (Kind != PSK_DirectEscapeOnCall &&
  473. Kind != PSK_IndirectEscapeOnCall)) &&
  474. "Call must not be NULL when escaping on call");
  475. for (unsigned i = 0, e = PointerEscapeCheckers.size(); i != e; ++i) {
  476. // If any checker declares the state infeasible (or if it starts that
  477. // way), bail out.
  478. if (!State)
  479. return nullptr;
  480. State = PointerEscapeCheckers[i](State, Escaped, Call, Kind, ETraits);
  481. }
  482. return State;
  483. }
  484. /// \brief Run checkers for handling assumptions on symbolic values.
  485. ProgramStateRef
  486. CheckerManager::runCheckersForEvalAssume(ProgramStateRef state,
  487. SVal Cond, bool Assumption) {
  488. for (unsigned i = 0, e = EvalAssumeCheckers.size(); i != e; ++i) {
  489. // If any checker declares the state infeasible (or if it starts that way),
  490. // bail out.
  491. if (!state)
  492. return nullptr;
  493. state = EvalAssumeCheckers[i](state, Cond, Assumption);
  494. }
  495. return state;
  496. }
  497. /// \brief Run checkers for evaluating a call.
  498. /// Only one checker will evaluate the call.
  499. void CheckerManager::runCheckersForEvalCall(ExplodedNodeSet &Dst,
  500. const ExplodedNodeSet &Src,
  501. const CallEvent &Call,
  502. ExprEngine &Eng) {
  503. const CallExpr *CE = cast<CallExpr>(Call.getOriginExpr());
  504. for (ExplodedNodeSet::iterator
  505. NI = Src.begin(), NE = Src.end(); NI != NE; ++NI) {
  506. ExplodedNode *Pred = *NI;
  507. bool anyEvaluated = false;
  508. ExplodedNodeSet checkDst;
  509. NodeBuilder B(Pred, checkDst, Eng.getBuilderContext());
  510. // Check if any of the EvalCall callbacks can evaluate the call.
  511. for (std::vector<EvalCallFunc>::iterator
  512. EI = EvalCallCheckers.begin(), EE = EvalCallCheckers.end();
  513. EI != EE; ++EI) {
  514. ProgramPoint::Kind K = ProgramPoint::PostStmtKind;
  515. const ProgramPoint &L = ProgramPoint::getProgramPoint(CE, K,
  516. Pred->getLocationContext(), EI->Checker);
  517. bool evaluated = false;
  518. { // CheckerContext generates transitions(populates checkDest) on
  519. // destruction, so introduce the scope to make sure it gets properly
  520. // populated.
  521. CheckerContext C(B, Eng, Pred, L);
  522. evaluated = (*EI)(CE, C);
  523. }
  524. assert(!(evaluated && anyEvaluated)
  525. && "There are more than one checkers evaluating the call");
  526. if (evaluated) {
  527. anyEvaluated = true;
  528. Dst.insert(checkDst);
  529. #ifdef NDEBUG
  530. break; // on release don't check that no other checker also evals.
  531. #endif
  532. }
  533. }
  534. // If none of the checkers evaluated the call, ask ExprEngine to handle it.
  535. if (!anyEvaluated) {
  536. NodeBuilder B(Pred, Dst, Eng.getBuilderContext());
  537. Eng.defaultEvalCall(B, Pred, Call);
  538. }
  539. }
  540. }
  541. /// \brief Run checkers for the entire Translation Unit.
  542. void CheckerManager::runCheckersOnEndOfTranslationUnit(
  543. const TranslationUnitDecl *TU,
  544. AnalysisManager &mgr,
  545. BugReporter &BR) {
  546. for (unsigned i = 0, e = EndOfTranslationUnitCheckers.size(); i != e; ++i)
  547. EndOfTranslationUnitCheckers[i](TU, mgr, BR);
  548. }
  549. void CheckerManager::runCheckersForPrintState(raw_ostream &Out,
  550. ProgramStateRef State,
  551. const char *NL, const char *Sep) {
  552. for (llvm::DenseMap<CheckerTag, CheckerRef>::iterator
  553. I = CheckerTags.begin(), E = CheckerTags.end(); I != E; ++I)
  554. I->second->printState(Out, State, NL, Sep);
  555. }
  556. //===----------------------------------------------------------------------===//
  557. // Internal registration functions for AST traversing.
  558. //===----------------------------------------------------------------------===//
  559. void CheckerManager::_registerForDecl(CheckDeclFunc checkfn,
  560. HandlesDeclFunc isForDeclFn) {
  561. DeclCheckerInfo info = { checkfn, isForDeclFn };
  562. DeclCheckers.push_back(info);
  563. }
  564. void CheckerManager::_registerForBody(CheckDeclFunc checkfn) {
  565. BodyCheckers.push_back(checkfn);
  566. }
  567. //===----------------------------------------------------------------------===//
  568. // Internal registration functions for path-sensitive checking.
  569. //===----------------------------------------------------------------------===//
  570. void CheckerManager::_registerForPreStmt(CheckStmtFunc checkfn,
  571. HandlesStmtFunc isForStmtFn) {
  572. StmtCheckerInfo info = { checkfn, isForStmtFn, /*IsPreVisit*/true };
  573. StmtCheckers.push_back(info);
  574. }
  575. void CheckerManager::_registerForPostStmt(CheckStmtFunc checkfn,
  576. HandlesStmtFunc isForStmtFn) {
  577. StmtCheckerInfo info = { checkfn, isForStmtFn, /*IsPreVisit*/false };
  578. StmtCheckers.push_back(info);
  579. }
  580. void CheckerManager::_registerForPreObjCMessage(CheckObjCMessageFunc checkfn) {
  581. PreObjCMessageCheckers.push_back(checkfn);
  582. }
  583. void CheckerManager::_registerForObjCMessageNil(CheckObjCMessageFunc checkfn) {
  584. ObjCMessageNilCheckers.push_back(checkfn);
  585. }
  586. void CheckerManager::_registerForPostObjCMessage(CheckObjCMessageFunc checkfn) {
  587. PostObjCMessageCheckers.push_back(checkfn);
  588. }
  589. void CheckerManager::_registerForPreCall(CheckCallFunc checkfn) {
  590. PreCallCheckers.push_back(checkfn);
  591. }
  592. void CheckerManager::_registerForPostCall(CheckCallFunc checkfn) {
  593. PostCallCheckers.push_back(checkfn);
  594. }
  595. void CheckerManager::_registerForLocation(CheckLocationFunc checkfn) {
  596. LocationCheckers.push_back(checkfn);
  597. }
  598. void CheckerManager::_registerForBind(CheckBindFunc checkfn) {
  599. BindCheckers.push_back(checkfn);
  600. }
  601. void CheckerManager::_registerForEndAnalysis(CheckEndAnalysisFunc checkfn) {
  602. EndAnalysisCheckers.push_back(checkfn);
  603. }
  604. void CheckerManager::_registerForBeginFunction(CheckBeginFunctionFunc checkfn) {
  605. BeginFunctionCheckers.push_back(checkfn);
  606. }
  607. void CheckerManager::_registerForEndFunction(CheckEndFunctionFunc checkfn) {
  608. EndFunctionCheckers.push_back(checkfn);
  609. }
  610. void CheckerManager::_registerForBranchCondition(
  611. CheckBranchConditionFunc checkfn) {
  612. BranchConditionCheckers.push_back(checkfn);
  613. }
  614. void CheckerManager::_registerForLiveSymbols(CheckLiveSymbolsFunc checkfn) {
  615. LiveSymbolsCheckers.push_back(checkfn);
  616. }
  617. void CheckerManager::_registerForDeadSymbols(CheckDeadSymbolsFunc checkfn) {
  618. DeadSymbolsCheckers.push_back(checkfn);
  619. }
  620. void CheckerManager::_registerForRegionChanges(CheckRegionChangesFunc checkfn) {
  621. RegionChangesCheckers.push_back(checkfn);
  622. }
  623. void CheckerManager::_registerForPointerEscape(CheckPointerEscapeFunc checkfn){
  624. PointerEscapeCheckers.push_back(checkfn);
  625. }
  626. void CheckerManager::_registerForConstPointerEscape(
  627. CheckPointerEscapeFunc checkfn) {
  628. PointerEscapeCheckers.push_back(checkfn);
  629. }
  630. void CheckerManager::_registerForEvalAssume(EvalAssumeFunc checkfn) {
  631. EvalAssumeCheckers.push_back(checkfn);
  632. }
  633. void CheckerManager::_registerForEvalCall(EvalCallFunc checkfn) {
  634. EvalCallCheckers.push_back(checkfn);
  635. }
  636. void CheckerManager::_registerForEndOfTranslationUnit(
  637. CheckEndOfTranslationUnit checkfn) {
  638. EndOfTranslationUnitCheckers.push_back(checkfn);
  639. }
  640. //===----------------------------------------------------------------------===//
  641. // Implementation details.
  642. //===----------------------------------------------------------------------===//
  643. const CheckerManager::CachedStmtCheckers &
  644. CheckerManager::getCachedStmtCheckersFor(const Stmt *S, bool isPreVisit) {
  645. assert(S);
  646. unsigned Key = (S->getStmtClass() << 1) | unsigned(isPreVisit);
  647. CachedStmtCheckersMapTy::iterator CCI = CachedStmtCheckersMap.find(Key);
  648. if (CCI != CachedStmtCheckersMap.end())
  649. return CCI->second;
  650. // Find the checkers that should run for this Stmt and cache them.
  651. CachedStmtCheckers &Checkers = CachedStmtCheckersMap[Key];
  652. for (unsigned i = 0, e = StmtCheckers.size(); i != e; ++i) {
  653. StmtCheckerInfo &Info = StmtCheckers[i];
  654. if (Info.IsPreVisit == isPreVisit && Info.IsForStmtFn(S))
  655. Checkers.push_back(Info.CheckFn);
  656. }
  657. return Checkers;
  658. }
  659. CheckerManager::~CheckerManager() {
  660. for (unsigned i = 0, e = CheckerDtors.size(); i != e; ++i)
  661. CheckerDtors[i]();
  662. }