clang
10.0.0git
|
#include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
#include "clang/AST/Decl.h"
#include "clang/AST/DeclBase.h"
#include "clang/AST/DeclObjC.h"
#include "clang/AST/Expr.h"
#include "clang/AST/ExprCXX.h"
#include "clang/AST/ParentMap.h"
#include "clang/AST/Stmt.h"
#include "clang/AST/StmtCXX.h"
#include "clang/AST/StmtObjC.h"
#include "clang/Analysis/AnalysisDeclContext.h"
#include "clang/Analysis/CFG.h"
#include "clang/Analysis/CFGStmtMap.h"
#include "clang/Analysis/PathDiagnostic.h"
#include "clang/Analysis/ProgramPoint.h"
#include "clang/Basic/LLVM.h"
#include "clang/Basic/SourceLocation.h"
#include "clang/Basic/SourceManager.h"
#include "clang/StaticAnalyzer/Core/AnalyzerOptions.h"
#include "clang/StaticAnalyzer/Core/BugReporter/BugReporterVisitors.h"
#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
#include "clang/StaticAnalyzer/Core/Checker.h"
#include "clang/StaticAnalyzer/Core/CheckerManager.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/ExplodedGraph.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h"
#include "llvm/ADT/ArrayRef.h"
#include "llvm/ADT/DenseMap.h"
#include "llvm/ADT/DenseSet.h"
#include "llvm/ADT/FoldingSet.h"
#include "llvm/ADT/None.h"
#include "llvm/ADT/Optional.h"
#include "llvm/ADT/STLExtras.h"
#include "llvm/ADT/SmallPtrSet.h"
#include "llvm/ADT/SmallString.h"
#include "llvm/ADT/SmallVector.h"
#include "llvm/ADT/Statistic.h"
#include "llvm/ADT/StringRef.h"
#include "llvm/ADT/iterator_range.h"
#include "llvm/Support/Casting.h"
#include "llvm/Support/Compiler.h"
#include "llvm/Support/ErrorHandling.h"
#include "llvm/Support/MemoryBuffer.h"
#include "llvm/Support/raw_ostream.h"
#include <algorithm>
#include <cassert>
#include <cstddef>
#include <iterator>
#include <memory>
#include <queue>
#include <string>
#include <tuple>
#include <utility>
#include <vector>
Go to the source code of this file.
Macros | |
#define | DEBUG_TYPE "BugReporter" |
Typedefs | |
using | OptimizedCallsSet = llvm::DenseSet< const PathDiagnosticCallPiece * > |
Functions | |
STATISTIC (MaxBugClassSize, "The maximum number of bug reports in the same equivalence class") | |
STATISTIC (MaxValidBugClassSize, "The maximum number of bug reports in the same equivalence class " "where at least one report is valid (not suppressed)") | |
static PathDiagnosticEventPiece * | eventsDescribeSameCondition (PathDiagnosticEventPiece *X, PathDiagnosticEventPiece *Y) |
static void | removeRedundantMsgs (PathPieces &path) |
An optimization pass over PathPieces that removes redundant diagnostics generated by both ConditionBRVisitor and TrackConstraintBRVisitor. More... | |
static bool | removeUnneededCalls (const PathDiagnosticConstruct &C, PathPieces &pieces, const PathSensitiveBugReport *R, bool IsInteresting=false) |
Recursively scan through a path and prune out calls and macros pieces that aren't needed. More... | |
static void | removePopUpNotes (PathPieces &Path) |
Same logic as above to remove extra pieces. More... | |
static bool | hasImplicitBody (const Decl *D) |
Returns true if the given decl has been implicitly given a body, either by the analyzer or by the compiler proper. More... | |
static void | adjustCallLocations (PathPieces &Pieces, PathDiagnosticLocation *LastCallLocation=nullptr) |
Recursively scan through a path and make sure that all call pieces have valid locations. More... | |
static void | removeEdgesToDefaultInitializers (PathPieces &Pieces) |
Remove edges in and out of C++ default initializer expressions. More... | |
static void | removePiecesWithInvalidLocations (PathPieces &Pieces) |
Remove all pieces with invalid locations as these cannot be serialized. More... | |
static const Stmt * | getEnclosingParent (const Stmt *S, const ParentMap &PM) |
static PathDiagnosticLocation | getEnclosingStmtLocation (const Stmt *S, const LocationContext *LC, bool allowNestedContexts=false) |
static void | CompactMacroExpandedPieces (PathPieces &path, const SourceManager &SM) |
CompactMacroExpandedPieces - This function postprocesses a PathDiagnostic object and collapses PathDiagosticPieces that are expanded by macros. More... | |
static bool | isLoop (const Stmt *Term) |
static bool | isJumpToFalseBranch (const BlockEdge *BE) |
static bool | isContainedByStmt (const ParentMap &PM, const Stmt *S, const Stmt *SubS) |
static const Stmt * | getStmtBeforeCond (const ParentMap &PM, const Stmt *Term, const ExplodedNode *N) |
static bool | isInLoopBody (const ParentMap &PM, const Stmt *S, const Stmt *Term) |
static void | addEdgeToPath (PathPieces &path, PathDiagnosticLocation &PrevLoc, PathDiagnosticLocation NewLoc) |
Adds a sanitized control-flow diagnostic edge to a path. More... | |
static const Stmt * | getTerminatorCondition (const CFGBlock *B) |
A customized wrapper for CFGBlock::getTerminatorCondition() which returns the element for ObjCForCollectionStmts. More... | |
static std::unique_ptr< FilesToLineNumsMap > | findExecutedLines (const SourceManager &SM, const ExplodedNode *N) |
static std::unique_ptr< PathDiagnostic > | generateDiagnosticForBasicReport (const BasicBugReport *R) |
static std::unique_ptr< PathDiagnostic > | generateEmptyDiagnosticForReport (const PathSensitiveBugReport *R, const SourceManager &SM) |
static const Stmt * | getStmtParent (const Stmt *S, const ParentMap &PM) |
static bool | isConditionForTerminator (const Stmt *S, const Stmt *Cond) |
static bool | isIncrementOrInitInForLoop (const Stmt *S, const Stmt *FL) |
static void | addContextEdges (PathPieces &pieces, const LocationContext *LC) |
Adds synthetic edges from top-level statements to their subexpressions. More... | |
static void | simplifySimpleBranches (PathPieces &pieces) |
Move edges from a branch condition to a branch target when the condition is simple. More... | |
static Optional< size_t > | getLengthOnSingleLine (const SourceManager &SM, SourceRange Range) |
Returns the number of bytes in the given (character-based) SourceRange. More... | |
static Optional< size_t > | getLengthOnSingleLine (const SourceManager &SM, const Stmt *S) |
static void | removeContextCycles (PathPieces &Path, const SourceManager &SM) |
Eliminate two-edge cycles created by addContextEdges(). More... | |
static bool | lexicalContains (const ParentMap &PM, const Stmt *X, const Stmt *Y) |
Return true if X is contained by Y. More... | |
static void | removePunyEdges (PathPieces &path, const SourceManager &SM, const ParentMap &PM) |
static void | removeIdenticalEvents (PathPieces &path) |
static bool | optimizeEdges (const PathDiagnosticConstruct &C, PathPieces &path, OptimizedCallsSet &OCS) |
static void | dropFunctionEntryEdge (const PathDiagnosticConstruct &C, PathPieces &Path) |
Drop the very first edge in a path, which should be a function entry edge. More... | |
static void | updateExecutedLinesWithDiagnosticPieces (PathDiagnostic &PD) |
Populate executes lines with lines containing at least one diagnostics. More... | |
template<class T > | |
static void | insertToInterestingnessMap (llvm::DenseMap< T, bugreporter::TrackingKind > &InterestingnessMap, T Val, bugreporter::TrackingKind TKind) |
Variables | |
constexpr llvm::StringLiteral | StrEnteringLoop = "Entering loop body" |
constexpr llvm::StringLiteral | StrLoopBodyZero = "Loop body executed 0 times" |
constexpr llvm::StringLiteral | StrLoopRangeEmpty |
constexpr llvm::StringLiteral | StrLoopCollectionEmpty |
#define DEBUG_TYPE "BugReporter" |
Definition at line 76 of file BugReporter.cpp.
using OptimizedCallsSet = llvm::DenseSet<const PathDiagnosticCallPiece *> |
Definition at line 1403 of file BugReporter.cpp.
|
static |
Adds synthetic edges from top-level statements to their subexpressions.
This avoids a "swoosh" effect, where an edge from a top-level statement A points to a sub-expression B.1 that's not at the start of B. In these cases, we'd like to see an edge from A to B, then another one from B to B.1.
Definition at line 1410 of file BugReporter.cpp.
References getEnclosingStmtLocation(), clang::LocationContext::getParentMap(), and getStmtParent().
|
static |
Adds a sanitized control-flow diagnostic edge to a path.
Definition at line 1075 of file BugReporter.cpp.
References clang::SourceLocation::isInvalid().
Referenced by updateExecutedLinesWithDiagnosticPieces().
|
static |
Recursively scan through a path and make sure that all call pieces have valid locations.
Definition at line 490 of file BugReporter.cpp.
References hasImplicitBody(), and clang::if().
Referenced by updateExecutedLinesWithDiagnosticPieces().
|
static |
CompactMacroExpandedPieces - This function postprocesses a PathDiagnostic object and collapses PathDiagosticPieces that are expanded by macros.
Definition at line 2599 of file BugReporter.cpp.
References clang::AnalyzerOptions::AnalyzeAll, clang::ento::PathDiagnosticLocation::createSingleLocation(), clang::ento::BugReporter::EmitBasicReport(), clang::ento::BugReporter::emitReport(), clang::ento::PathSensitiveBugReporter::emitReport(), End, clang::interp::EQ(), findExecutedLines(), generateDiagnosticForBasicReport(), clang::ento::BugReporter::generateDiagnosticForConsumerMap(), clang::ento::PathSensitiveBugReporter::generatePathDiagnostics(), clang::SourceRange::getBegin(), clang::Decl::getBody(), clang::SourceRange::getEnd(), clang::SourceManager::getExpansionLineNumber(), clang::SourceManager::getExpansionLoc(), clang::SourceManager::getFileID(), clang::Stmt::getSourceRange(), clang::AnalysisDeclContext::isBodyAutosynthesized(), clang::AnalysisDeclContext::isBodyAutosynthesizedFromModelFile(), clang::SourceLocation::isFileID(), clang::ento::AnalysisManager::isInCodeFile(), clang::SourceLocation::isMacroID(), clang::SourceLocation::isValid(), Line, and updateExecutedLinesWithDiagnosticPieces().
Referenced by getEnclosingStmtLocation(), and updateExecutedLinesWithDiagnosticPieces().
|
static |
Drop the very first edge in a path, which should be a function entry edge.
If the first edge is not a function entry edge (say, because the first statement had an invalid source location), this function does nothing.
Definition at line 1935 of file BugReporter.cpp.
References clang::ento::PathDiagnosticLocation::createBegin().
Referenced by updateExecutedLinesWithDiagnosticPieces().
|
static |
|
static |
Referenced by CompactMacroExpandedPieces(), and generateEmptyDiagnosticForReport().
|
static |
Definition at line 1312 of file BugReporter.cpp.
Referenced by CompactMacroExpandedPieces().
|
static |
Definition at line 1322 of file BugReporter.cpp.
References findExecutedLines().
Referenced by updateExecutedLinesWithDiagnosticPieces().
Definition at line 613 of file BugReporter.cpp.
References clang::ParentMap::getParentIgnoreParens(), clang::Stmt::getStmtClass(), clang::ParentMap::isConsumedExpr(), and Parent.
Referenced by getEnclosingStmtLocation().
|
static |
Definition at line 636 of file BugReporter.cpp.
References CompactMacroExpandedPieces(), End, clang::Decl::getASTContext(), clang::LocationContext::getDecl(), getEnclosingParent(), clang::CFGBlock::getLabel(), clang::LocationContext::getParentMap(), clang::ASTContext::getSourceManager(), clang::Stmt::getStmtClass(), P, and Parent.
Referenced by addContextEdges().
|
static |
Returns the number of bytes in the given (character-based) SourceRange.
If the locations in the range are not on the same line, returns None.
Note that this does not do a precise user-visible character or column count.
Definition at line 1561 of file BugReporter.cpp.
References clang::SourceRange::getBegin(), clang::SourceManager::getBuffer(), clang::SourceRange::getEnd(), clang::SourceManager::getExpansionLoc(), clang::SourceManager::getExpansionRange(), clang::SourceManager::getFileID(), and clang::SourceManager::getFileOffset().
Referenced by getLengthOnSingleLine(), optimizeEdges(), removeContextCycles(), and removePunyEdges().
|
static |
Definition at line 1591 of file BugReporter.cpp.
References getLengthOnSingleLine(), and clang::Stmt::getSourceRange().
|
static |
Definition at line 1027 of file BugReporter.cpp.
References isContainedByStmt().
Definition at line 1332 of file BugReporter.cpp.
References clang::ParentMap::getParentIgnoreParens().
Referenced by addContextEdges(), and optimizeEdges().
A customized wrapper for CFGBlock::getTerminatorCondition() which returns the element for ObjCForCollectionStmts.
Definition at line 1102 of file BugReporter.cpp.
References clang::CFGBlock::getTerminatorCondition().
Referenced by clang::CFGBlock::getTerminatorCondition(), and clang::CFGBlock::getTerminatorStmt().
Returns true if the given decl has been implicitly given a body, either by the analyzer or by the compiler proper.
Definition at line 482 of file BugReporter.cpp.
References clang::Decl::hasBody(), and clang::Decl::isImplicit().
Referenced by adjustCallLocations().
|
static |
Definition at line 2176 of file BugReporter.cpp.
References clang::ento::PathSensitiveBugReport::markInteresting(), and V.
Definition at line 1353 of file BugReporter.cpp.
References clang::Stmt::getStmtClass().
Referenced by optimizeEdges(), removePunyEdges(), and simplifySimpleBranches().
Definition at line 1017 of file BugReporter.cpp.
References clang::ParentMap::getParent().
Referenced by getStmtBeforeCond(), and isInLoopBody().
Definition at line 1394 of file BugReporter.cpp.
Referenced by optimizeEdges().
Definition at line 1041 of file BugReporter.cpp.
References clang::Stmt::getStmtClass(), and isContainedByStmt().
Definition at line 1011 of file BugReporter.cpp.
References clang::BlockEdge::getDst(), clang::BlockEdge::getSrc(), clang::CFGBlock::succ_begin(), and clang::CFGBlock::succ_size().
Definition at line 998 of file BugReporter.cpp.
References clang::Stmt::getStmtClass().
Return true if X is contained by Y.
Definition at line 1667 of file BugReporter.cpp.
References clang::ParentMap::getParent().
Referenced by optimizeEdges().
|
static |
Definition at line 1753 of file BugReporter.cpp.
References getLengthOnSingleLine(), clang::LocationContext::getParentMap(), getStmtParent(), isConditionForTerminator(), clang::ParentMap::isConsumedExpr(), isIncrementOrInitInForLoop(), and lexicalContains().
Referenced by updateExecutedLinesWithDiagnosticPieces().
|
static |
Eliminate two-edge cycles created by addContextEdges().
Once all the context edges are in place, there are plenty of cases where there's a single edge from a top-level statement to a subexpression, followed by a single path note, and then a reverse edge to get back out to the top level. If the statement is simple enough, the subexpression edges just add noise and make it harder to understand what's going on.
This function only removes edges in pairs, because removing only one edge might leave other edges dangling.
This will not remove edges in more complicated situations:
Definition at line 1612 of file BugReporter.cpp.
References getLengthOnSingleLine().
|
static |
Remove edges in and out of C++ default initializer expressions.
These are for fields that have in-class initializers, as opposed to being initialized explicitly in a constructor or braced list.
Definition at line 523 of file BugReporter.cpp.
References clang::ento::CF, and End.
Referenced by updateExecutedLinesWithDiagnosticPieces().
|
static |
Definition at line 1730 of file BugReporter.cpp.
|
static |
Remove all pieces with invalid locations as these cannot be serialized.
We might have pieces with invalid locations as a result of inlining Body Farm generated functions.
Definition at line 557 of file BugReporter.cpp.
References clang::ento::PathDiagnosticLocation::createDeclEnd().
Referenced by updateExecutedLinesWithDiagnosticPieces().
|
static |
Same logic as above to remove extra pieces.
Definition at line 471 of file BugReporter.cpp.
Referenced by updateExecutedLinesWithDiagnosticPieces().
|
static |
Definition at line 1677 of file BugReporter.cpp.
References clang::Stmt::getBeginLoc(), getLengthOnSingleLine(), clang::ParentMap::getParent(), clang::SourceManager::isBeforeInTranslationUnit(), isConditionForTerminator(), and clang::SourceManager::isWrittenInSameFile().
|
static |
An optimization pass over PathPieces that removes redundant diagnostics generated by both ConditionBRVisitor and TrackConstraintBRVisitor.
Both BugReporterVisitors use different methods to generate diagnostics, with one capable of emitting diagnostics in some cases but not in others. This can lead to redundant diagnostic pieces at the same point in a path.
Definition at line 368 of file BugReporter.cpp.
References clang::ento::PathDiagnosticPiece::Call, clang::ento::PathDiagnosticPiece::ControlFlow, clang::ento::PathDiagnosticPiece::Event, eventsDescribeSameCondition(), clang::ento::PathDiagnosticPiece::Macro, clang::ento::PathDiagnosticPiece::Note, and clang::ento::PathDiagnosticPiece::PopUp.
Referenced by updateExecutedLinesWithDiagnosticPieces().
|
static |
Recursively scan through a path and prune out calls and macros pieces that aren't needed.
Return true if afterwards the path contains "interesting stuff" which means it shouldn't be pruned from the parent path.
Definition at line 418 of file BugReporter.cpp.
References clang::ento::PathDiagnosticPiece::Call, clang::ento::PathDiagnosticPiece::ControlFlow, clang::ento::PathDiagnosticPiece::Event, clang::ento::PathDiagnosticPiece::Macro, clang::ento::PathDiagnosticPiece::Note, and clang::ento::PathDiagnosticPiece::PopUp.
Referenced by updateExecutedLinesWithDiagnosticPieces().
|
static |
Move edges from a branch condition to a branch target when the condition is simple.
This restructures some of the work of addContextEdges. That function creates edges this may destroy, but they work together to create a more aesthetically set of edges around branches. After the call to addContextEdges, we may have (1) an edge to the branch, (2) an edge from the branch to the branch condition, and (3) an edge from the branch condition to the branch target. We keep (1), but may wish to remove (2) and move the source of (3) to the branch if the branch condition is simple.
Definition at line 1491 of file BugReporter.cpp.
References isConditionForTerminator().
STATISTIC | ( | MaxBugClassSize | , |
"The maximum number of bug reports in the same equivalence class" | |||
) |
STATISTIC | ( | MaxValidBugClassSize | , |
"The maximum number of bug reports in the same equivalence class " "where at least one report is valid (not suppressed)" | |||
) |
|
static |
Populate executes lines with lines containing at least one diagnostics.
Definition at line 1952 of file BugReporter.cpp.
References addEdgeToPath(), adjustCallLocations(), CompactMacroExpandedPieces(), clang::ento::PathDiagnosticLocation::createBegin(), dropFunctionEntryEdge(), generateEmptyDiagnosticForReport(), clang::LocationContext::getDecl(), clang::FullSourceLoc::getFileID(), clang::FullSourceLoc::getLineNumber(), clang::FileID::isValid(), optimizeEdges(), removeEdgesToDefaultInitializers(), removePiecesWithInvalidLocations(), removePopUpNotes(), removeRedundantMsgs(), removeUnneededCalls(), clang::AnalyzerOptions::SilencedCheckersAndPackages, and SM.
Referenced by CompactMacroExpandedPieces().
constexpr llvm::StringLiteral StrEnteringLoop = "Entering loop body" |
Definition at line 1109 of file BugReporter.cpp.
constexpr llvm::StringLiteral StrLoopBodyZero = "Loop body executed 0 times" |
Definition at line 1110 of file BugReporter.cpp.
constexpr llvm::StringLiteral StrLoopCollectionEmpty |
Definition at line 1113 of file BugReporter.cpp.
constexpr llvm::StringLiteral StrLoopRangeEmpty |
Definition at line 1111 of file BugReporter.cpp.