CheckerManager.cpp 27 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713
  1. //===--- CheckerManager.cpp - Static Analyzer Checker Manager -------------===//
  2. //
  3. // The LLVM Compiler Infrastructure
  4. //
  5. // This file is distributed under the University of Illinois Open Source
  6. // License. See LICENSE.TXT for details.
  7. //
  8. //===----------------------------------------------------------------------===//
  9. //
  10. // Defines the Static Analyzer Checker Manager.
  11. //
  12. //===----------------------------------------------------------------------===//
  13. #include "clang/StaticAnalyzer/Core/CheckerManager.h"
  14. #include "clang/AST/DeclBase.h"
  15. #include "clang/Analysis/ProgramPoint.h"
  16. #include "clang/StaticAnalyzer/Core/Checker.h"
  17. #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
  18. #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
  19. using namespace clang;
  20. using namespace ento;
  21. bool CheckerManager::hasPathSensitiveCheckers() const {
  22. return !StmtCheckers.empty() ||
  23. !PreObjCMessageCheckers.empty() ||
  24. !PostObjCMessageCheckers.empty() ||
  25. !PreCallCheckers.empty() ||
  26. !PostCallCheckers.empty() ||
  27. !LocationCheckers.empty() ||
  28. !BindCheckers.empty() ||
  29. !EndAnalysisCheckers.empty() ||
  30. !EndFunctionCheckers.empty() ||
  31. !BranchConditionCheckers.empty() ||
  32. !LiveSymbolsCheckers.empty() ||
  33. !DeadSymbolsCheckers.empty() ||
  34. !RegionChangesCheckers.empty() ||
  35. !EvalAssumeCheckers.empty() ||
  36. !EvalCallCheckers.empty();
  37. }
  38. void CheckerManager::finishedCheckerRegistration() {
  39. #ifndef NDEBUG
  40. // Make sure that for every event that has listeners, there is at least
  41. // one dispatcher registered for it.
  42. for (llvm::DenseMap<EventTag, EventInfo>::iterator
  43. I = Events.begin(), E = Events.end(); I != E; ++I)
  44. assert(I->second.HasDispatcher && "No dispatcher registered for an event");
  45. #endif
  46. }
  47. //===----------------------------------------------------------------------===//
  48. // Functions for running checkers for AST traversing..
  49. //===----------------------------------------------------------------------===//
  50. void CheckerManager::runCheckersOnASTDecl(const Decl *D, AnalysisManager& mgr,
  51. BugReporter &BR) {
  52. assert(D);
  53. unsigned DeclKind = D->getKind();
  54. CachedDeclCheckers *checkers = 0;
  55. CachedDeclCheckersMapTy::iterator CCI = CachedDeclCheckersMap.find(DeclKind);
  56. if (CCI != CachedDeclCheckersMap.end()) {
  57. checkers = &(CCI->second);
  58. } else {
  59. // Find the checkers that should run for this Decl and cache them.
  60. checkers = &CachedDeclCheckersMap[DeclKind];
  61. for (unsigned i = 0, e = DeclCheckers.size(); i != e; ++i) {
  62. DeclCheckerInfo &info = DeclCheckers[i];
  63. if (info.IsForDeclFn(D))
  64. checkers->push_back(info.CheckFn);
  65. }
  66. }
  67. assert(checkers);
  68. for (CachedDeclCheckers::iterator
  69. I = checkers->begin(), E = checkers->end(); I != E; ++I)
  70. (*I)(D, mgr, BR);
  71. }
  72. void CheckerManager::runCheckersOnASTBody(const Decl *D, AnalysisManager& mgr,
  73. BugReporter &BR) {
  74. assert(D && D->hasBody());
  75. for (unsigned i = 0, e = BodyCheckers.size(); i != e; ++i)
  76. BodyCheckers[i](D, mgr, BR);
  77. }
  78. //===----------------------------------------------------------------------===//
  79. // Functions for running checkers for path-sensitive checking.
  80. //===----------------------------------------------------------------------===//
  81. template <typename CHECK_CTX>
  82. static void expandGraphWithCheckers(CHECK_CTX checkCtx,
  83. ExplodedNodeSet &Dst,
  84. const ExplodedNodeSet &Src) {
  85. const NodeBuilderContext &BldrCtx = checkCtx.Eng.getBuilderContext();
  86. if (Src.empty())
  87. return;
  88. typename CHECK_CTX::CheckersTy::const_iterator
  89. I = checkCtx.checkers_begin(), E = checkCtx.checkers_end();
  90. if (I == E) {
  91. Dst.insert(Src);
  92. return;
  93. }
  94. ExplodedNodeSet Tmp1, Tmp2;
  95. const ExplodedNodeSet *PrevSet = &Src;
  96. for (; I != E; ++I) {
  97. ExplodedNodeSet *CurrSet = 0;
  98. if (I+1 == E)
  99. CurrSet = &Dst;
  100. else {
  101. CurrSet = (PrevSet == &Tmp1) ? &Tmp2 : &Tmp1;
  102. CurrSet->clear();
  103. }
  104. NodeBuilder B(*PrevSet, *CurrSet, BldrCtx);
  105. for (ExplodedNodeSet::iterator NI = PrevSet->begin(), NE = PrevSet->end();
  106. NI != NE; ++NI) {
  107. checkCtx.runChecker(*I, B, *NI);
  108. }
  109. // If all the produced transitions are sinks, stop.
  110. if (CurrSet->empty())
  111. return;
  112. // Update which NodeSet is the current one.
  113. PrevSet = CurrSet;
  114. }
  115. }
  116. namespace {
  117. struct CheckStmtContext {
  118. typedef SmallVectorImpl<CheckerManager::CheckStmtFunc> CheckersTy;
  119. bool IsPreVisit;
  120. const CheckersTy &Checkers;
  121. const Stmt *S;
  122. ExprEngine &Eng;
  123. bool WasInlined;
  124. CheckersTy::const_iterator checkers_begin() { return Checkers.begin(); }
  125. CheckersTy::const_iterator checkers_end() { return Checkers.end(); }
  126. CheckStmtContext(bool isPreVisit, const CheckersTy &checkers,
  127. const Stmt *s, ExprEngine &eng, bool wasInlined = false)
  128. : IsPreVisit(isPreVisit), Checkers(checkers), S(s), Eng(eng),
  129. WasInlined(wasInlined) {}
  130. void runChecker(CheckerManager::CheckStmtFunc checkFn,
  131. NodeBuilder &Bldr, ExplodedNode *Pred) {
  132. // FIXME: Remove respondsToCallback from CheckerContext;
  133. ProgramPoint::Kind K = IsPreVisit ? ProgramPoint::PreStmtKind :
  134. ProgramPoint::PostStmtKind;
  135. const ProgramPoint &L = ProgramPoint::getProgramPoint(S, K,
  136. Pred->getLocationContext(), checkFn.Checker);
  137. CheckerContext C(Bldr, Eng, Pred, L, WasInlined);
  138. checkFn(S, C);
  139. }
  140. };
  141. }
  142. /// \brief Run checkers for visiting Stmts.
  143. void CheckerManager::runCheckersForStmt(bool isPreVisit,
  144. ExplodedNodeSet &Dst,
  145. const ExplodedNodeSet &Src,
  146. const Stmt *S,
  147. ExprEngine &Eng,
  148. bool WasInlined) {
  149. CheckStmtContext C(isPreVisit, getCachedStmtCheckersFor(S, isPreVisit),
  150. S, Eng, WasInlined);
  151. expandGraphWithCheckers(C, Dst, Src);
  152. }
  153. namespace {
  154. struct CheckObjCMessageContext {
  155. typedef std::vector<CheckerManager::CheckObjCMessageFunc> CheckersTy;
  156. bool IsPreVisit, WasInlined;
  157. const CheckersTy &Checkers;
  158. const ObjCMethodCall &Msg;
  159. ExprEngine &Eng;
  160. CheckersTy::const_iterator checkers_begin() { return Checkers.begin(); }
  161. CheckersTy::const_iterator checkers_end() { return Checkers.end(); }
  162. CheckObjCMessageContext(bool isPreVisit, const CheckersTy &checkers,
  163. const ObjCMethodCall &msg, ExprEngine &eng,
  164. bool wasInlined)
  165. : IsPreVisit(isPreVisit), WasInlined(wasInlined), Checkers(checkers),
  166. Msg(msg), Eng(eng) { }
  167. void runChecker(CheckerManager::CheckObjCMessageFunc checkFn,
  168. NodeBuilder &Bldr, ExplodedNode *Pred) {
  169. const ProgramPoint &L = Msg.getProgramPoint(IsPreVisit,checkFn.Checker);
  170. CheckerContext C(Bldr, Eng, Pred, L, WasInlined);
  171. checkFn(*Msg.cloneWithState<ObjCMethodCall>(Pred->getState()), C);
  172. }
  173. };
  174. }
  175. /// \brief Run checkers for visiting obj-c messages.
  176. void CheckerManager::runCheckersForObjCMessage(bool isPreVisit,
  177. ExplodedNodeSet &Dst,
  178. const ExplodedNodeSet &Src,
  179. const ObjCMethodCall &msg,
  180. ExprEngine &Eng,
  181. bool WasInlined) {
  182. CheckObjCMessageContext C(isPreVisit,
  183. isPreVisit ? PreObjCMessageCheckers
  184. : PostObjCMessageCheckers,
  185. msg, Eng, WasInlined);
  186. expandGraphWithCheckers(C, Dst, Src);
  187. }
  188. namespace {
  189. // FIXME: This has all the same signatures as CheckObjCMessageContext.
  190. // Is there a way we can merge the two?
  191. struct CheckCallContext {
  192. typedef std::vector<CheckerManager::CheckCallFunc> CheckersTy;
  193. bool IsPreVisit, WasInlined;
  194. const CheckersTy &Checkers;
  195. const CallEvent &Call;
  196. ExprEngine &Eng;
  197. CheckersTy::const_iterator checkers_begin() { return Checkers.begin(); }
  198. CheckersTy::const_iterator checkers_end() { return Checkers.end(); }
  199. CheckCallContext(bool isPreVisit, const CheckersTy &checkers,
  200. const CallEvent &call, ExprEngine &eng,
  201. bool wasInlined)
  202. : IsPreVisit(isPreVisit), WasInlined(wasInlined), Checkers(checkers),
  203. Call(call), Eng(eng) { }
  204. void runChecker(CheckerManager::CheckCallFunc checkFn,
  205. NodeBuilder &Bldr, ExplodedNode *Pred) {
  206. const ProgramPoint &L = Call.getProgramPoint(IsPreVisit,checkFn.Checker);
  207. CheckerContext C(Bldr, Eng, Pred, L, WasInlined);
  208. checkFn(*Call.cloneWithState(Pred->getState()), C);
  209. }
  210. };
  211. }
  212. /// \brief Run checkers for visiting an abstract call event.
  213. void CheckerManager::runCheckersForCallEvent(bool isPreVisit,
  214. ExplodedNodeSet &Dst,
  215. const ExplodedNodeSet &Src,
  216. const CallEvent &Call,
  217. ExprEngine &Eng,
  218. bool WasInlined) {
  219. CheckCallContext C(isPreVisit,
  220. isPreVisit ? PreCallCheckers
  221. : PostCallCheckers,
  222. Call, Eng, WasInlined);
  223. expandGraphWithCheckers(C, Dst, Src);
  224. }
  225. namespace {
  226. struct CheckLocationContext {
  227. typedef std::vector<CheckerManager::CheckLocationFunc> CheckersTy;
  228. const CheckersTy &Checkers;
  229. SVal Loc;
  230. bool IsLoad;
  231. const Stmt *NodeEx; /* Will become a CFGStmt */
  232. const Stmt *BoundEx;
  233. ExprEngine &Eng;
  234. CheckersTy::const_iterator checkers_begin() { return Checkers.begin(); }
  235. CheckersTy::const_iterator checkers_end() { return Checkers.end(); }
  236. CheckLocationContext(const CheckersTy &checkers,
  237. SVal loc, bool isLoad, const Stmt *NodeEx,
  238. const Stmt *BoundEx,
  239. ExprEngine &eng)
  240. : Checkers(checkers), Loc(loc), IsLoad(isLoad), NodeEx(NodeEx),
  241. BoundEx(BoundEx), Eng(eng) {}
  242. void runChecker(CheckerManager::CheckLocationFunc checkFn,
  243. NodeBuilder &Bldr, ExplodedNode *Pred) {
  244. ProgramPoint::Kind K = IsLoad ? ProgramPoint::PreLoadKind :
  245. ProgramPoint::PreStoreKind;
  246. const ProgramPoint &L =
  247. ProgramPoint::getProgramPoint(NodeEx, K,
  248. Pred->getLocationContext(),
  249. checkFn.Checker);
  250. CheckerContext C(Bldr, Eng, Pred, L);
  251. checkFn(Loc, IsLoad, BoundEx, C);
  252. }
  253. };
  254. }
  255. /// \brief Run checkers for load/store of a location.
  256. void CheckerManager::runCheckersForLocation(ExplodedNodeSet &Dst,
  257. const ExplodedNodeSet &Src,
  258. SVal location, bool isLoad,
  259. const Stmt *NodeEx,
  260. const Stmt *BoundEx,
  261. ExprEngine &Eng) {
  262. CheckLocationContext C(LocationCheckers, location, isLoad, NodeEx,
  263. BoundEx, Eng);
  264. expandGraphWithCheckers(C, Dst, Src);
  265. }
  266. namespace {
  267. struct CheckBindContext {
  268. typedef std::vector<CheckerManager::CheckBindFunc> CheckersTy;
  269. const CheckersTy &Checkers;
  270. SVal Loc;
  271. SVal Val;
  272. const Stmt *S;
  273. ExprEngine &Eng;
  274. const ProgramPoint &PP;
  275. CheckersTy::const_iterator checkers_begin() { return Checkers.begin(); }
  276. CheckersTy::const_iterator checkers_end() { return Checkers.end(); }
  277. CheckBindContext(const CheckersTy &checkers,
  278. SVal loc, SVal val, const Stmt *s, ExprEngine &eng,
  279. const ProgramPoint &pp)
  280. : Checkers(checkers), Loc(loc), Val(val), S(s), Eng(eng), PP(pp) {}
  281. void runChecker(CheckerManager::CheckBindFunc checkFn,
  282. NodeBuilder &Bldr, ExplodedNode *Pred) {
  283. const ProgramPoint &L = PP.withTag(checkFn.Checker);
  284. CheckerContext C(Bldr, Eng, Pred, L);
  285. checkFn(Loc, Val, S, C);
  286. }
  287. };
  288. }
  289. /// \brief Run checkers for binding of a value to a location.
  290. void CheckerManager::runCheckersForBind(ExplodedNodeSet &Dst,
  291. const ExplodedNodeSet &Src,
  292. SVal location, SVal val,
  293. const Stmt *S, ExprEngine &Eng,
  294. const ProgramPoint &PP) {
  295. CheckBindContext C(BindCheckers, location, val, S, Eng, PP);
  296. expandGraphWithCheckers(C, Dst, Src);
  297. }
  298. void CheckerManager::runCheckersForEndAnalysis(ExplodedGraph &G,
  299. BugReporter &BR,
  300. ExprEngine &Eng) {
  301. for (unsigned i = 0, e = EndAnalysisCheckers.size(); i != e; ++i)
  302. EndAnalysisCheckers[i](G, BR, Eng);
  303. }
  304. /// \brief Run checkers for end of path.
  305. // Note, We do not chain the checker output (like in expandGraphWithCheckers)
  306. // for this callback since end of path nodes are expected to be final.
  307. void CheckerManager::runCheckersForEndFunction(NodeBuilderContext &BC,
  308. ExplodedNodeSet &Dst,
  309. ExplodedNode *Pred,
  310. ExprEngine &Eng) {
  311. // We define the builder outside of the loop bacause if at least one checkers
  312. // creates a sucsessor for Pred, we do not need to generate an
  313. // autotransition for it.
  314. NodeBuilder Bldr(Pred, Dst, BC);
  315. for (unsigned i = 0, e = EndFunctionCheckers.size(); i != e; ++i) {
  316. CheckEndFunctionFunc checkFn = EndFunctionCheckers[i];
  317. const ProgramPoint &L = BlockEntrance(BC.Block,
  318. Pred->getLocationContext(),
  319. checkFn.Checker);
  320. CheckerContext C(Bldr, Eng, Pred, L);
  321. checkFn(C);
  322. }
  323. }
  324. namespace {
  325. struct CheckBranchConditionContext {
  326. typedef std::vector<CheckerManager::CheckBranchConditionFunc> CheckersTy;
  327. const CheckersTy &Checkers;
  328. const Stmt *Condition;
  329. ExprEngine &Eng;
  330. CheckersTy::const_iterator checkers_begin() { return Checkers.begin(); }
  331. CheckersTy::const_iterator checkers_end() { return Checkers.end(); }
  332. CheckBranchConditionContext(const CheckersTy &checkers,
  333. const Stmt *Cond, ExprEngine &eng)
  334. : Checkers(checkers), Condition(Cond), Eng(eng) {}
  335. void runChecker(CheckerManager::CheckBranchConditionFunc checkFn,
  336. NodeBuilder &Bldr, ExplodedNode *Pred) {
  337. ProgramPoint L = PostCondition(Condition, Pred->getLocationContext(),
  338. checkFn.Checker);
  339. CheckerContext C(Bldr, Eng, Pred, L);
  340. checkFn(Condition, C);
  341. }
  342. };
  343. }
  344. /// \brief Run checkers for branch condition.
  345. void CheckerManager::runCheckersForBranchCondition(const Stmt *Condition,
  346. ExplodedNodeSet &Dst,
  347. ExplodedNode *Pred,
  348. ExprEngine &Eng) {
  349. ExplodedNodeSet Src;
  350. Src.insert(Pred);
  351. CheckBranchConditionContext C(BranchConditionCheckers, Condition, Eng);
  352. expandGraphWithCheckers(C, Dst, Src);
  353. }
  354. /// \brief Run checkers for live symbols.
  355. void CheckerManager::runCheckersForLiveSymbols(ProgramStateRef state,
  356. SymbolReaper &SymReaper) {
  357. for (unsigned i = 0, e = LiveSymbolsCheckers.size(); i != e; ++i)
  358. LiveSymbolsCheckers[i](state, SymReaper);
  359. }
  360. namespace {
  361. struct CheckDeadSymbolsContext {
  362. typedef std::vector<CheckerManager::CheckDeadSymbolsFunc> CheckersTy;
  363. const CheckersTy &Checkers;
  364. SymbolReaper &SR;
  365. const Stmt *S;
  366. ExprEngine &Eng;
  367. ProgramPoint::Kind ProgarmPointKind;
  368. CheckersTy::const_iterator checkers_begin() { return Checkers.begin(); }
  369. CheckersTy::const_iterator checkers_end() { return Checkers.end(); }
  370. CheckDeadSymbolsContext(const CheckersTy &checkers, SymbolReaper &sr,
  371. const Stmt *s, ExprEngine &eng,
  372. ProgramPoint::Kind K)
  373. : Checkers(checkers), SR(sr), S(s), Eng(eng), ProgarmPointKind(K) { }
  374. void runChecker(CheckerManager::CheckDeadSymbolsFunc checkFn,
  375. NodeBuilder &Bldr, ExplodedNode *Pred) {
  376. const ProgramPoint &L = ProgramPoint::getProgramPoint(S, ProgarmPointKind,
  377. Pred->getLocationContext(), checkFn.Checker);
  378. CheckerContext C(Bldr, Eng, Pred, L);
  379. // Note, do not pass the statement to the checkers without letting them
  380. // differentiate if we ran remove dead bindings before or after the
  381. // statement.
  382. checkFn(SR, C);
  383. }
  384. };
  385. }
  386. /// \brief Run checkers for dead symbols.
  387. void CheckerManager::runCheckersForDeadSymbols(ExplodedNodeSet &Dst,
  388. const ExplodedNodeSet &Src,
  389. SymbolReaper &SymReaper,
  390. const Stmt *S,
  391. ExprEngine &Eng,
  392. ProgramPoint::Kind K) {
  393. CheckDeadSymbolsContext C(DeadSymbolsCheckers, SymReaper, S, Eng, K);
  394. expandGraphWithCheckers(C, Dst, Src);
  395. }
  396. /// \brief True if at least one checker wants to check region changes.
  397. bool CheckerManager::wantsRegionChangeUpdate(ProgramStateRef state) {
  398. for (unsigned i = 0, e = RegionChangesCheckers.size(); i != e; ++i)
  399. if (RegionChangesCheckers[i].WantUpdateFn(state))
  400. return true;
  401. return false;
  402. }
  403. /// \brief Run checkers for region changes.
  404. ProgramStateRef
  405. CheckerManager::runCheckersForRegionChanges(ProgramStateRef state,
  406. const InvalidatedSymbols *invalidated,
  407. ArrayRef<const MemRegion *> ExplicitRegions,
  408. ArrayRef<const MemRegion *> Regions,
  409. const CallEvent *Call) {
  410. for (unsigned i = 0, e = RegionChangesCheckers.size(); i != e; ++i) {
  411. // If any checker declares the state infeasible (or if it starts that way),
  412. // bail out.
  413. if (!state)
  414. return NULL;
  415. state = RegionChangesCheckers[i].CheckFn(state, invalidated,
  416. ExplicitRegions, Regions, Call);
  417. }
  418. return state;
  419. }
  420. /// \brief Run checkers to process symbol escape event.
  421. ProgramStateRef
  422. CheckerManager::runCheckersForPointerEscape(ProgramStateRef State,
  423. const InvalidatedSymbols &Escaped,
  424. const CallEvent *Call,
  425. PointerEscapeKind Kind,
  426. bool IsConst) {
  427. assert((Call != NULL ||
  428. (Kind != PSK_DirectEscapeOnCall &&
  429. Kind != PSK_IndirectEscapeOnCall)) &&
  430. "Call must not be NULL when escaping on call");
  431. for (unsigned i = 0, e = PointerEscapeCheckers.size(); i != e; ++i) {
  432. // If any checker declares the state infeasible (or if it starts that
  433. // way), bail out.
  434. if (!State)
  435. return NULL;
  436. State = PointerEscapeCheckers[i](State, Escaped, Call, Kind, IsConst);
  437. }
  438. return State;
  439. }
  440. /// \brief Run checkers for handling assumptions on symbolic values.
  441. ProgramStateRef
  442. CheckerManager::runCheckersForEvalAssume(ProgramStateRef state,
  443. SVal Cond, bool Assumption) {
  444. for (unsigned i = 0, e = EvalAssumeCheckers.size(); i != e; ++i) {
  445. // If any checker declares the state infeasible (or if it starts that way),
  446. // bail out.
  447. if (!state)
  448. return NULL;
  449. state = EvalAssumeCheckers[i](state, Cond, Assumption);
  450. }
  451. return state;
  452. }
  453. /// \brief Run checkers for evaluating a call.
  454. /// Only one checker will evaluate the call.
  455. void CheckerManager::runCheckersForEvalCall(ExplodedNodeSet &Dst,
  456. const ExplodedNodeSet &Src,
  457. const CallEvent &Call,
  458. ExprEngine &Eng) {
  459. const CallExpr *CE = cast<CallExpr>(Call.getOriginExpr());
  460. for (ExplodedNodeSet::iterator
  461. NI = Src.begin(), NE = Src.end(); NI != NE; ++NI) {
  462. ExplodedNode *Pred = *NI;
  463. bool anyEvaluated = false;
  464. ExplodedNodeSet checkDst;
  465. NodeBuilder B(Pred, checkDst, Eng.getBuilderContext());
  466. // Check if any of the EvalCall callbacks can evaluate the call.
  467. for (std::vector<EvalCallFunc>::iterator
  468. EI = EvalCallCheckers.begin(), EE = EvalCallCheckers.end();
  469. EI != EE; ++EI) {
  470. ProgramPoint::Kind K = ProgramPoint::PostStmtKind;
  471. const ProgramPoint &L = ProgramPoint::getProgramPoint(CE, K,
  472. Pred->getLocationContext(), EI->Checker);
  473. bool evaluated = false;
  474. { // CheckerContext generates transitions(populates checkDest) on
  475. // destruction, so introduce the scope to make sure it gets properly
  476. // populated.
  477. CheckerContext C(B, Eng, Pred, L);
  478. evaluated = (*EI)(CE, C);
  479. }
  480. assert(!(evaluated && anyEvaluated)
  481. && "There are more than one checkers evaluating the call");
  482. if (evaluated) {
  483. anyEvaluated = true;
  484. Dst.insert(checkDst);
  485. #ifdef NDEBUG
  486. break; // on release don't check that no other checker also evals.
  487. #endif
  488. }
  489. }
  490. // If none of the checkers evaluated the call, ask ExprEngine to handle it.
  491. if (!anyEvaluated) {
  492. NodeBuilder B(Pred, Dst, Eng.getBuilderContext());
  493. Eng.defaultEvalCall(B, Pred, Call);
  494. }
  495. }
  496. }
  497. /// \brief Run checkers for the entire Translation Unit.
  498. void CheckerManager::runCheckersOnEndOfTranslationUnit(
  499. const TranslationUnitDecl *TU,
  500. AnalysisManager &mgr,
  501. BugReporter &BR) {
  502. for (unsigned i = 0, e = EndOfTranslationUnitCheckers.size(); i != e; ++i)
  503. EndOfTranslationUnitCheckers[i](TU, mgr, BR);
  504. }
  505. void CheckerManager::runCheckersForPrintState(raw_ostream &Out,
  506. ProgramStateRef State,
  507. const char *NL, const char *Sep) {
  508. for (llvm::DenseMap<CheckerTag, CheckerRef>::iterator
  509. I = CheckerTags.begin(), E = CheckerTags.end(); I != E; ++I)
  510. I->second->printState(Out, State, NL, Sep);
  511. }
  512. //===----------------------------------------------------------------------===//
  513. // Internal registration functions for AST traversing.
  514. //===----------------------------------------------------------------------===//
  515. void CheckerManager::_registerForDecl(CheckDeclFunc checkfn,
  516. HandlesDeclFunc isForDeclFn) {
  517. DeclCheckerInfo info = { checkfn, isForDeclFn };
  518. DeclCheckers.push_back(info);
  519. }
  520. void CheckerManager::_registerForBody(CheckDeclFunc checkfn) {
  521. BodyCheckers.push_back(checkfn);
  522. }
  523. //===----------------------------------------------------------------------===//
  524. // Internal registration functions for path-sensitive checking.
  525. //===----------------------------------------------------------------------===//
  526. void CheckerManager::_registerForPreStmt(CheckStmtFunc checkfn,
  527. HandlesStmtFunc isForStmtFn) {
  528. StmtCheckerInfo info = { checkfn, isForStmtFn, /*IsPreVisit*/true };
  529. StmtCheckers.push_back(info);
  530. }
  531. void CheckerManager::_registerForPostStmt(CheckStmtFunc checkfn,
  532. HandlesStmtFunc isForStmtFn) {
  533. StmtCheckerInfo info = { checkfn, isForStmtFn, /*IsPreVisit*/false };
  534. StmtCheckers.push_back(info);
  535. }
  536. void CheckerManager::_registerForPreObjCMessage(CheckObjCMessageFunc checkfn) {
  537. PreObjCMessageCheckers.push_back(checkfn);
  538. }
  539. void CheckerManager::_registerForPostObjCMessage(CheckObjCMessageFunc checkfn) {
  540. PostObjCMessageCheckers.push_back(checkfn);
  541. }
  542. void CheckerManager::_registerForPreCall(CheckCallFunc checkfn) {
  543. PreCallCheckers.push_back(checkfn);
  544. }
  545. void CheckerManager::_registerForPostCall(CheckCallFunc checkfn) {
  546. PostCallCheckers.push_back(checkfn);
  547. }
  548. void CheckerManager::_registerForLocation(CheckLocationFunc checkfn) {
  549. LocationCheckers.push_back(checkfn);
  550. }
  551. void CheckerManager::_registerForBind(CheckBindFunc checkfn) {
  552. BindCheckers.push_back(checkfn);
  553. }
  554. void CheckerManager::_registerForEndAnalysis(CheckEndAnalysisFunc checkfn) {
  555. EndAnalysisCheckers.push_back(checkfn);
  556. }
  557. void CheckerManager::_registerForEndFunction(CheckEndFunctionFunc checkfn) {
  558. EndFunctionCheckers.push_back(checkfn);
  559. }
  560. void CheckerManager::_registerForBranchCondition(
  561. CheckBranchConditionFunc checkfn) {
  562. BranchConditionCheckers.push_back(checkfn);
  563. }
  564. void CheckerManager::_registerForLiveSymbols(CheckLiveSymbolsFunc checkfn) {
  565. LiveSymbolsCheckers.push_back(checkfn);
  566. }
  567. void CheckerManager::_registerForDeadSymbols(CheckDeadSymbolsFunc checkfn) {
  568. DeadSymbolsCheckers.push_back(checkfn);
  569. }
  570. void CheckerManager::_registerForRegionChanges(CheckRegionChangesFunc checkfn,
  571. WantsRegionChangeUpdateFunc wantUpdateFn) {
  572. RegionChangesCheckerInfo info = {checkfn, wantUpdateFn};
  573. RegionChangesCheckers.push_back(info);
  574. }
  575. void CheckerManager::_registerForPointerEscape(CheckPointerEscapeFunc checkfn){
  576. PointerEscapeCheckers.push_back(checkfn);
  577. }
  578. void CheckerManager::_registerForConstPointerEscape(
  579. CheckPointerEscapeFunc checkfn) {
  580. PointerEscapeCheckers.push_back(checkfn);
  581. }
  582. void CheckerManager::_registerForEvalAssume(EvalAssumeFunc checkfn) {
  583. EvalAssumeCheckers.push_back(checkfn);
  584. }
  585. void CheckerManager::_registerForEvalCall(EvalCallFunc checkfn) {
  586. EvalCallCheckers.push_back(checkfn);
  587. }
  588. void CheckerManager::_registerForEndOfTranslationUnit(
  589. CheckEndOfTranslationUnit checkfn) {
  590. EndOfTranslationUnitCheckers.push_back(checkfn);
  591. }
  592. //===----------------------------------------------------------------------===//
  593. // Implementation details.
  594. //===----------------------------------------------------------------------===//
  595. const CheckerManager::CachedStmtCheckers &
  596. CheckerManager::getCachedStmtCheckersFor(const Stmt *S, bool isPreVisit) {
  597. assert(S);
  598. unsigned Key = (S->getStmtClass() << 1) | unsigned(isPreVisit);
  599. CachedStmtCheckersMapTy::iterator CCI = CachedStmtCheckersMap.find(Key);
  600. if (CCI != CachedStmtCheckersMap.end())
  601. return CCI->second;
  602. // Find the checkers that should run for this Stmt and cache them.
  603. CachedStmtCheckers &Checkers = CachedStmtCheckersMap[Key];
  604. for (unsigned i = 0, e = StmtCheckers.size(); i != e; ++i) {
  605. StmtCheckerInfo &Info = StmtCheckers[i];
  606. if (Info.IsPreVisit == isPreVisit && Info.IsForStmtFn(S))
  607. Checkers.push_back(Info.CheckFn);
  608. }
  609. return Checkers;
  610. }
  611. CheckerManager::~CheckerManager() {
  612. for (unsigned i = 0, e = CheckerDtors.size(); i != e; ++i)
  613. CheckerDtors[i]();
  614. }