clang
6.0.0
|
Functions | |
bool | trackNullOrUndefValue (const ExplodedNode *N, const Stmt *S, BugReport &R, bool IsArg=false, bool EnableNullFPSuppression=true) |
Attempts to add visitors to trace a null or undefined value back to its point of origin, whether it is a symbol constrained to null or an explicit assignment. More... | |
const Expr * | getDerefExpr (const Stmt *S) |
Given that expression S represents a pointer that would be dereferenced, try to find a sub-expression from which the pointer came from. More... | |
const Stmt * | GetDenomExpr (const ExplodedNode *N) |
const Stmt * | GetRetValExpr (const ExplodedNode *N) |
bool | isDeclRefExprToReference (const Expr *E) |
const Stmt * clang::ento::bugreporter::GetDenomExpr | ( | const ExplodedNode * | N | ) |
Definition at line 121 of file BugReporterVisitors.cpp.
Given that expression S represents a pointer that would be dereferenced, try to find a sub-expression from which the pointer came from.
This is used for tracking down origins of a null or undefined value: "this is null because that is null because that is null" etc. We wipe away field and element offsets because they merely add offsets. We also wipe away all casts except lvalue-to-rvalue casts, because the latter represent an actual pointer dereference; however, we remove the final lvalue-to-rvalue cast before returning from this function because it demonstrates more clearly from where the pointer rvalue was loaded. Examples: x->y.z ==> x (lvalue) foo()->y.z ==> foo() (rvalue)
Definition at line 57 of file BugReporterVisitors.cpp.
Referenced by emitBug().
const Stmt * clang::ento::bugreporter::GetRetValExpr | ( | const ExplodedNode * | N | ) |
Definition at line 128 of file BugReporterVisitors.cpp.
Definition at line 38 of file BugReporterVisitors.cpp.
bool clang::ento::bugreporter::trackNullOrUndefValue | ( | const ExplodedNode * | N, |
const Stmt * | S, | ||
BugReport & | R, | ||
bool | IsArg = false , |
||
bool | EnableNullFPSuppression = true |
||
) |
Attempts to add visitors to trace a null or undefined value back to its point of origin, whether it is a symbol constrained to null or an explicit assignment.
N | A node "downstream" from the evaluation of the statement. |
S | The statement whose value is null or undefined. |
R | The bug report to which visitors should be attached. |
IsArg | Whether the statement is an argument to an inlined function. If this is the case, N must be the CallEnter node for the function. |
EnableNullFPSuppression | Whether we should employ false positive suppression (inlined defensive checks, returned null). |
true
does not actually imply that any visitors were added. Definition at line 981 of file BugReporterVisitors.cpp.
Referenced by describeUninitializedArgumentInCall(), emitBug(), GetCFNumberSize(), and clang::ento::FindLastStoreBRVisitor::VisitNode().