Skip to content

Commit 1fc679c

Browse files
fangyi-zhoufangyi-zhou
committed
Convert the checkers
1 parent de88ff7 commit 1fc679c

File tree

16 files changed

+85
-63
lines changed

16 files changed

+85
-63
lines changed

‎clang/include/clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -172,10 +172,10 @@ class SValBuilder {
172172

173173
// Forwarding methods to SymbolManager.
174174

175-
const SymbolConjured *conjureSymbol(const CFGBlock::CFGElementRef ElemRef,
176-
const LocationContext *LCtx,
177-
QualType type, unsigned visitCount,
178-
const void *symbolTag = nullptr) {
175+
const SymbolConjured *
176+
conjureSymbol(const CFGBlock::ConstCFGElementRef ElemRef,
177+
const LocationContext *LCtx, QualType type, unsigned visitCount,
178+
const void *symbolTag = nullptr) {
179179
return SymMgr.conjureSymbol(ElemRef, LCtx, type, visitCount, symbolTag);
180180
}
181181

‎clang/include/clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -81,19 +81,18 @@ class SymbolRegionValue : public SymbolData {
8181
/// A symbol representing the result of an expression in the case when we do
8282
/// not know anything about what the expression is.
8383
class SymbolConjured : public SymbolData {
84-
const Stmt *S;
84+
const CFGBlock::ConstCFGElementRef ElemRef;
8585
QualType T;
8686
unsigned Count;
8787
const LocationContext *LCtx;
8888
const void *SymbolTag;
89-
const CFGBlock::ConstCFGElementRef ElemRef;
9089

9190
friend class SymExprAllocator;
9291
SymbolConjured(SymbolID sym, CFGBlock::ConstCFGElementRef elemRef,
9392
const LocationContext *lctx, QualType t, unsigned count,
9493
const void *symbolTag)
95-
: SymbolData(SymbolConjuredKind, sym), S(nullptr), T(t), Count(count),
96-
LCtx(lctx), SymbolTag(symbolTag), ElemRef(elemRef) {
94+
: SymbolData(SymbolConjuredKind, sym), ElemRef(elemRef), T(t),
95+
Count(count), LCtx(lctx), SymbolTag(symbolTag) {
9796
// FIXME: 's' might be a nullptr if we're conducting invalidation
9897
// that was caused by a destructor call on a temporary object,
9998
// which has no statement associated with it.
@@ -109,7 +108,7 @@ class SymbolConjured : public SymbolData {
109108
if (auto Stmt = ElemRef->getAs<CFGStmt>()) {
110109
return Stmt->getStmt();
111110
}
112-
return S;
111+
return nullptr;
113112
}
114113
unsigned getCount() const { return Count; }
115114
/// It might return null.

‎clang/lib/StaticAnalyzer/Checkers/CStringChecker.cpp‎

Lines changed: 21 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1515,7 +1515,8 @@ void CStringChecker::evalCopyCommon(CheckerContext &C, const CallEvent &Call,
15151515
// conjure a return value for later.
15161516
if (lastElement.isUnknown())
15171517
lastElement = C.getSValBuilder().conjureSymbolVal(
1518-
nullptr, Call.getOriginExpr(), LCtx, C.blockCount());
1518+
nullptr, Call.getCFGElementRef(), LCtx,
1519+
Call.getOriginExpr()->getType(), C.blockCount());
15191520

15201521
// The byte after the last byte copied is the return value.
15211522
state = state->BindExpr(Call.getOriginExpr(), LCtx, lastElement);
@@ -1665,8 +1666,9 @@ void CStringChecker::evalMemcmp(CheckerContext &C, const CallEvent &Call,
16651666
State = CheckBufferAccess(C, State, Left, Size, AccessKind::read, CK);
16661667
if (State) {
16671668
// The return value is the comparison result, which we don't know.
1668-
SVal CmpV = Builder.conjureSymbolVal(nullptr, Call.getOriginExpr(), LCtx,
1669-
C.blockCount());
1669+
SVal CmpV = Builder.conjureSymbolVal(
1670+
nullptr, Call.getCFGElementRef(), LCtx,
1671+
Call.getOriginExpr()->getType(), C.blockCount());
16701672
State = State->BindExpr(Call.getOriginExpr(), LCtx, CmpV);
16711673
C.addTransition(State);
16721674
}
@@ -1770,7 +1772,8 @@ void CStringChecker::evalstrLengthCommon(CheckerContext &C,
17701772
// All we know is the return value is the min of the string length
17711773
// and the limit. This is better than nothing.
17721774
result = C.getSValBuilder().conjureSymbolVal(
1773-
nullptr, Call.getOriginExpr(), LCtx, C.blockCount());
1775+
nullptr, Call.getCFGElementRef(), LCtx,
1776+
Call.getOriginExpr()->getType(), C.blockCount());
17741777
NonLoc resultNL = result.castAs<NonLoc>();
17751778

17761779
if (strLengthNL) {
@@ -1794,7 +1797,8 @@ void CStringChecker::evalstrLengthCommon(CheckerContext &C,
17941797
// value, so it can be used in constraints, at least.
17951798
if (result.isUnknown()) {
17961799
result = C.getSValBuilder().conjureSymbolVal(
1797-
nullptr, Call.getOriginExpr(), LCtx, C.blockCount());
1800+
nullptr, Call.getCFGElementRef(), LCtx,
1801+
Call.getOriginExpr()->getType(), C.blockCount());
17981802
}
17991803
}
18001804

@@ -2261,8 +2265,9 @@ void CStringChecker::evalStrcpyCommon(CheckerContext &C, const CallEvent &Call,
22612265
// If this is a stpcpy-style copy, but we were unable to check for a buffer
22622266
// overflow, we still need a result. Conjure a return value.
22632267
if (ReturnEnd && Result.isUnknown()) {
2264-
Result = svalBuilder.conjureSymbolVal(nullptr, Call.getOriginExpr(), LCtx,
2265-
C.blockCount());
2268+
Result = svalBuilder.conjureSymbolVal(
2269+
nullptr, Call.getCFGElementRef(), LCtx,
2270+
Call.getOriginExpr()->getType(), C.blockCount());
22662271
}
22672272
}
22682273
// Set the return value.
@@ -2361,8 +2366,9 @@ void CStringChecker::evalStrcmpCommon(CheckerContext &C, const CallEvent &Call,
23612366
const StringLiteral *RightStrLiteral =
23622367
getCStringLiteral(C, state, Right.Expression, RightVal);
23632368
bool canComputeResult = false;
2364-
SVal resultVal = svalBuilder.conjureSymbolVal(nullptr, Call.getOriginExpr(),
2365-
LCtx, C.blockCount());
2369+
SVal resultVal = svalBuilder.conjureSymbolVal(
2370+
nullptr, Call.getCFGElementRef(), LCtx, Call.getOriginExpr()->getType(),
2371+
C.blockCount());
23662372

23672373
if (LeftStrLiteral && RightStrLiteral) {
23682374
StringRef LeftStrRef = LeftStrLiteral->getString();
@@ -2469,14 +2475,15 @@ void CStringChecker::evalStrsep(CheckerContext &C,
24692475
// further along in the same string, or NULL if there are no more tokens.
24702476
State =
24712477
State->bindLoc(*SearchStrLoc,
2472-
SVB.conjureSymbolVal(getTag(), Call.getOriginExpr(),
2478+
SVB.conjureSymbolVal(getTag(), Call.getCFGElementRef(),
24732479
LCtx, CharPtrTy, C.blockCount()),
24742480
LCtx);
24752481
} else {
24762482
assert(SearchStrVal.isUnknown());
24772483
// Conjure a symbolic value. It's the best we can do.
2478-
Result = SVB.conjureSymbolVal(nullptr, Call.getOriginExpr(), LCtx,
2479-
C.blockCount());
2484+
Result =
2485+
SVB.conjureSymbolVal(nullptr, Call.getCFGElementRef(), LCtx,
2486+
Call.getOriginExpr()->getType(), C.blockCount());
24802487
}
24812488

24822489
// Set the return value, and finish.
@@ -2520,7 +2527,8 @@ void CStringChecker::evalStdCopyCommon(CheckerContext &C,
25202527
SValBuilder &SVB = C.getSValBuilder();
25212528

25222529
SVal ResultVal =
2523-
SVB.conjureSymbolVal(nullptr, Call.getOriginExpr(), LCtx, C.blockCount());
2530+
SVB.conjureSymbolVal(nullptr, Call.getCFGElementRef(), LCtx,
2531+
Call.getOriginExpr()->getType(), C.blockCount());
25242532
State = State->BindExpr(Call.getOriginExpr(), LCtx, ResultVal);
25252533

25262534
C.addTransition(State);

‎clang/lib/StaticAnalyzer/Checkers/ErrnoModeling.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -124,7 +124,7 @@ void ErrnoModeling::checkBeginFunction(CheckerContext &C) const {
124124
// of the data member `ErrnoDecl` of the singleton `ErrnoModeling` checker
125125
// object.
126126
const SymbolConjured *Sym = SVB.conjureSymbol(
127-
nullptr, C.getLocationContext(),
127+
C.getCFGElementRef(), C.getLocationContext(),
128128
ACtx.getLValueReferenceType(ACtx.IntTy), C.blockCount(), &ErrnoDecl);
129129

130130
// The symbolic region is untyped, create a typed sub-region in it.

‎clang/lib/StaticAnalyzer/Checkers/ErrnoTesterChecker.cpp‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -131,7 +131,8 @@ void ErrnoTesterChecker::evalSetErrnoIfErrorRange(CheckerContext &C,
131131
ProgramStateRef StateFailure = State->BindExpr(
132132
Call.getOriginExpr(), C.getLocationContext(), SVB.makeIntVal(1, true));
133133
DefinedOrUnknownSVal ErrnoVal = SVB.conjureSymbolVal(
134-
nullptr, Call.getOriginExpr(), C.getLocationContext(), C.blockCount());
134+
nullptr, Call.getCFGElementRef(), C.getLocationContext(),
135+
Call.getOriginExpr()->getType(), C.blockCount());
135136
StateFailure = StateFailure->assume(ErrnoVal, true);
136137
assert(StateFailure && "Failed to assume on an initial value.");
137138
StateFailure =

‎clang/lib/StaticAnalyzer/Checkers/Iterator.cpp‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
//===----------------------------------------------------------------------===//
1212

1313
#include "Iterator.h"
14+
#include "clang/Analysis/CFG.h"
1415

1516
namespace clang {
1617
namespace ento {
@@ -206,15 +207,15 @@ ProgramStateRef setIteratorPosition(ProgramStateRef State, SVal Val,
206207
return nullptr;
207208
}
208209

209-
ProgramStateRef createIteratorPosition(ProgramStateRef State, SVal Val,
210-
const MemRegion *Cont, const Stmt *S,
211-
const LocationContext *LCtx,
212-
unsigned blockCount) {
210+
ProgramStateRef
211+
createIteratorPosition(ProgramStateRef State, SVal Val, const MemRegion *Cont,
212+
const CFGBlock::ConstCFGElementRef ElemRef,
213+
const LocationContext *LCtx, unsigned blockCount) {
213214
auto &StateMgr = State->getStateManager();
214215
auto &SymMgr = StateMgr.getSymbolManager();
215216
auto &ACtx = StateMgr.getContext();
216217

217-
auto Sym = SymMgr.conjureSymbol(S, LCtx, ACtx.LongTy, blockCount);
218+
auto Sym = SymMgr.conjureSymbol(ElemRef, LCtx, ACtx.LongTy, blockCount);
218219
State = assumeNoOverflow(State, Sym, 4);
219220
return setIteratorPosition(State, Val,
220221
IteratorPosition::getPosition(Cont, Sym));

‎clang/lib/StaticAnalyzer/Checkers/Iterator.h‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@
1313
#ifndef LLVM_CLANG_LIB_STATICANALYZER_CHECKERS_ITERATOR_H
1414
#define LLVM_CLANG_LIB_STATICANALYZER_CHECKERS_ITERATOR_H
1515

16+
#include "clang/Analysis/CFG.h"
1617
#include "clang/StaticAnalyzer/Core/PathSensitive/DynamicType.h"
1718
#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
1819
#include "clang/StaticAnalyzer/Core/PathSensitive/SymExpr.h"
@@ -164,10 +165,10 @@ const ContainerData *getContainerData(ProgramStateRef State,
164165
const IteratorPosition *getIteratorPosition(ProgramStateRef State, SVal Val);
165166
ProgramStateRef setIteratorPosition(ProgramStateRef State, SVal Val,
166167
const IteratorPosition &Pos);
167-
ProgramStateRef createIteratorPosition(ProgramStateRef State, SVal Val,
168-
const MemRegion *Cont, const Stmt *S,
169-
const LocationContext *LCtx,
170-
unsigned blockCount);
168+
ProgramStateRef
169+
createIteratorPosition(ProgramStateRef State, SVal Val, const MemRegion *Cont,
170+
const CFGBlock::ConstCFGElementRef ElemRef,
171+
const LocationContext *LCtx, unsigned blockCount);
171172
ProgramStateRef advancePosition(ProgramStateRef State, SVal Iter,
172173
OverloadedOperatorKind Op, SVal Distance);
173174
ProgramStateRef assumeNoOverflow(ProgramStateRef State, SymbolRef Sym,

‎clang/lib/StaticAnalyzer/Checkers/IteratorModeling.cpp‎

Lines changed: 17 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,8 @@ class IteratorModeling
9999
const Expr *OrigExpr,
100100
const AdvanceFn *Handler) const;
101101

102-
void handleComparison(CheckerContext &C, const Expr *CE, SVal RetVal,
102+
void handleComparison(CheckerContext &C, const Expr *CE,
103+
const CFGBlock::ConstCFGElementRef ElemRef, SVal RetVal,
103104
SVal LVal, SVal RVal, OverloadedOperatorKind Op) const;
104105
void processComparison(CheckerContext &C, ProgramStateRef State,
105106
SymbolRef Sym1, SymbolRef Sym2, SVal RetVal,
@@ -271,7 +272,7 @@ void IteratorModeling::checkPostStmt(const BinaryOperator *BO,
271272

272273
if (isSimpleComparisonOperator(BO->getOpcode())) {
273274
SVal Result = State->getSVal(BO, C.getLocationContext());
274-
handleComparison(C, BO, Result, LVal, RVal,
275+
handleComparison(C, BO, C.getCFGElementRef(), Result, LVal, RVal,
275276
BinaryOperator::getOverloadedOperator(OK));
276277
} else if (isRandomIncrOrDecrOperator(OK)) {
277278
// In case of operator+ the iterator can be either on the LHS (eg.: it + 1),
@@ -355,13 +356,15 @@ IteratorModeling::handleOverloadedOperator(CheckerContext &C,
355356
return;
356357

357358
if (const auto *InstCall = dyn_cast<CXXInstanceCall>(&Call)) {
358-
handleComparison(C, OrigExpr, Call.getReturnValue(),
359-
InstCall->getCXXThisVal(), Call.getArgSVal(0), Op);
359+
handleComparison(C, OrigExpr, Call.getCFGElementRef(),
360+
Call.getReturnValue(), InstCall->getCXXThisVal(),
361+
Call.getArgSVal(0), Op);
360362
return;
361363
}
362364

363-
handleComparison(C, OrigExpr, Call.getReturnValue(), Call.getArgSVal(0),
364-
Call.getArgSVal(1), Op);
365+
handleComparison(C, OrigExpr, Call.getCFGElementRef(),
366+
Call.getReturnValue(), Call.getArgSVal(0),
367+
Call.getArgSVal(1), Op);
365368
return;
366369
} else if (isRandomIncrOrDecrOperator(Op)) {
367370
const auto *OrigExpr = Call.getOriginExpr();
@@ -443,9 +446,10 @@ IteratorModeling::handleAdvanceLikeFunction(CheckerContext &C,
443446
}
444447
}
445448

446-
void IteratorModeling::handleComparison(CheckerContext &C, const Expr *CE,
447-
SVal RetVal, SVal LVal, SVal RVal,
448-
OverloadedOperatorKind Op) const {
449+
void IteratorModeling::handleComparison(
450+
CheckerContext &C, const Expr *CE,
451+
const CFGBlock::ConstCFGElementRef ElemRef, SVal RetVal, SVal LVal,
452+
SVal RVal, OverloadedOperatorKind Op) const {
449453
// Record the operands and the operator of the comparison for the next
450454
// evalAssume, if the result is a symbolic expression. If it is a concrete
451455
// value (only one branch is possible), then transfer the state between
@@ -467,7 +471,7 @@ void IteratorModeling::handleComparison(CheckerContext &C, const Expr *CE,
467471
SymbolRef Sym;
468472
if (!LPos || !RPos) {
469473
auto &SymMgr = C.getSymbolManager();
470-
Sym = SymMgr.conjureSymbol(CE, C.getLocationContext(),
474+
Sym = SymMgr.conjureSymbol(ElemRef, C.getLocationContext(),
471475
C.getASTContext().LongTy, C.blockCount());
472476
State = assumeNoOverflow(State, Sym, 4);
473477
}
@@ -494,7 +498,7 @@ void IteratorModeling::handleComparison(CheckerContext &C, const Expr *CE,
494498
auto &SymMgr = C.getSymbolManager();
495499
auto *LCtx = C.getLocationContext();
496500
RetVal = nonloc::SymbolVal(SymMgr.conjureSymbol(
497-
CE, LCtx, C.getASTContext().BoolTy, C.blockCount()));
501+
ElemRef, LCtx, C.getASTContext().BoolTy, C.blockCount()));
498502
State = State->BindExpr(CE, LCtx, RetVal);
499503
}
500504

@@ -688,7 +692,8 @@ void IteratorModeling::assignToContainer(CheckerContext &C, const Expr *CE,
688692

689693
auto State = C.getState();
690694
const auto *LCtx = C.getLocationContext();
691-
State = createIteratorPosition(State, RetVal, Cont, CE, LCtx, C.blockCount());
695+
State = createIteratorPosition(State, RetVal, Cont, C.getCFGElementRef(),
696+
LCtx, C.blockCount());
692697

693698
C.addTransition(State);
694699
}

‎clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1832,8 +1832,10 @@ ProgramStateRef MallocChecker::MallocBindRetVal(CheckerContext &C,
18321832
unsigned Count = C.blockCount();
18331833
SValBuilder &SVB = C.getSValBuilder();
18341834
const LocationContext *LCtx = C.getPredecessor()->getLocationContext();
1835-
DefinedSVal RetVal = isAlloca ? SVB.getAllocaRegionVal(CE, LCtx, Count)
1836-
: SVB.getConjuredHeapSymbolVal(CE, LCtx, Count);
1835+
DefinedSVal RetVal =
1836+
isAlloca ? SVB.getAllocaRegionVal(CE, LCtx, Count)
1837+
: SVB.getConjuredHeapSymbolVal(Call.getCFGElementRef(), LCtx,
1838+
CE->getType(), Count);
18371839
return State->BindExpr(CE, C.getLocationContext(), RetVal);
18381840
}
18391841

‎clang/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountChecker.cpp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -931,8 +931,8 @@ bool RetainCountChecker::evalCall(const CallEvent &Call,
931931
if (RetVal.isUnknown() ||
932932
(hasTrustedImplementationAnnotation && !ResultTy.isNull())) {
933933
SValBuilder &SVB = C.getSValBuilder();
934-
RetVal =
935-
SVB.conjureSymbolVal(nullptr, CE, LCtx, ResultTy, C.blockCount());
934+
RetVal = SVB.conjureSymbolVal(nullptr, Call.getCFGElementRef(), LCtx,
935+
ResultTy, C.blockCount());
936936
}
937937

938938
// Bind the value.

0 commit comments

Comments
 (0)