clang 22.0.0git
CheckerContext.h
Go to the documentation of this file.
1//== CheckerContext.h - Context info for path-sensitive checkers--*- C++ -*--=//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file defines CheckerContext that provides contextual info for
10// path-sensitive checkers.
11//
12//===----------------------------------------------------------------------===//
13
14#ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CHECKERCONTEXT_H
15#define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CHECKERCONTEXT_H
16
19#include <optional>
20
21namespace clang {
22namespace ento {
23
25 ExprEngine &Eng;
26 /// The current exploded(symbolic execution) graph node.
27 ExplodedNode *Pred;
28 /// The flag is true if the (state of the execution) has been modified
29 /// by the checker using this context. For example, a new transition has been
30 /// added or a bug report issued.
31 bool Changed;
32 /// The tagged location, which is used to generate all new nodes.
33 const ProgramPoint Location;
34 NodeBuilder &NB;
35
36public:
37 /// If we are post visiting a call, this flag will be set if the
38 /// call was inlined. In all other cases it will be false.
39 const bool wasInlined;
40
42 ExprEngine &eng,
43 ExplodedNode *pred,
44 const ProgramPoint &loc,
45 bool wasInlined = false)
46 : Eng(eng),
47 Pred(pred),
48 Changed(false),
49 Location(loc),
50 NB(builder),
52 assert(Pred->getState() &&
53 "We should not call the checkers on an empty state.");
54 assert(loc.getTag() && "The ProgramPoint associated with CheckerContext "
55 "must be tagged with the active checker.");
56 }
57
59 return Eng.getAnalysisManager();
60 }
62 return Eng.getAnalysisManager();
63 }
64
66 return Eng.getConstraintManager();
67 }
69 return Eng.getConstraintManager();
70 }
71
73 return Eng.getStoreManager();
74 }
75 const StoreManager &getStoreManager() const { return Eng.getStoreManager(); }
76
77 /// Returns the previous node in the exploded graph, which includes
78 /// the state of the program before the checker ran. Note, checkers should
79 /// not retain the node in their state since the nodes might get invalidated.
80 ExplodedNode *getPredecessor() { return Pred; }
81 const ExplodedNode *getPredecessor() const { return Pred; }
82 const ProgramPoint getLocation() const { return Location; }
83 const ProgramStateRef &getState() const { return Pred->getState(); }
84
85 /// Check if the checker changed the state of the execution; ex: added
86 /// a new transition or a bug report.
87 bool isDifferent() { return Changed; }
88 bool isDifferent() const { return Changed; }
89
90 /// Returns the number of times the current block has been visited
91 /// along the analyzed path.
92 unsigned blockCount() const {
93 return NB.getContext().blockCount();
94 }
95
97 return Eng.getContext();
98 }
99
100 const ASTContext &getASTContext() const { return Eng.getContext(); }
101
102 const LangOptions &getLangOpts() const {
103 return Eng.getContext().getLangOpts();
104 }
105
107 return Pred->getLocationContext();
108 }
109
111 return Pred->getStackFrame();
112 }
113
114 /// Return true if the current LocationContext has no caller context.
115 bool inTopFrame() const { return getLocationContext()->inTopFrame(); }
116
118 return Eng.getBugReporter();
119 }
120 const BugReporter &getBugReporter() const { return Eng.getBugReporter(); }
121
124 }
127 }
128
132 }
133
135 return Eng.getSValBuilder();
136 }
137 const SValBuilder &getSValBuilder() const { return Eng.getSValBuilder(); }
138
141 }
144 }
145
147 return Eng.getStateManager();
148 }
150 return Eng.getStateManager();
151 }
152
155 }
156
157 /// Get the blockID.
158 unsigned getBlockID() const {
159 return NB.getContext().getBlock()->getBlockID();
160 }
161
162 /// If the given node corresponds to a PostStore program point,
163 /// retrieve the location region as it was uttered in the code.
164 ///
165 /// This utility can be useful for generating extensive diagnostics, for
166 /// example, for finding variables that the given symbol was assigned to.
168 ProgramPoint L = N->getLocation();
169 if (std::optional<PostStore> PSL = L.getAs<PostStore>())
170 return reinterpret_cast<const MemRegion*>(PSL->getLocationValue());
171 return nullptr;
172 }
173
174 /// Get the value of arbitrary expressions at this point in the path.
175 SVal getSVal(const Stmt *S) const {
176 return Pred->getSVal(S);
177 }
178
180
181 /// Returns true if the value of \p E is greater than or equal to \p
182 /// Val under unsigned comparison.
183 bool isGreaterOrEqual(const Expr *E, unsigned long long Val);
184
185 /// Returns true if the value of \p E is negative.
186 bool isNegative(const Expr *E);
187
188 /// Generates a new transition in the program state graph
189 /// (ExplodedGraph). Uses the default CheckerContext predecessor node.
190 ///
191 /// @param State The state of the generated node. If not specified, the state
192 /// will not be changed, but the new node will have the checker's tag.
193 /// @param Tag The tag is used to uniquely identify the creation site. If no
194 /// tag is specified, a default tag, unique to the given checker,
195 /// will be used. Tags are used to prevent states generated at
196 /// different sites from caching out.
197 /// NOTE: If the State is unchanged and the Tag is nullptr, this may return a
198 /// node which is not tagged (instead of using the default tag corresponding
199 /// to the active checker). This is arguably a bug and should be fixed.
201 const ProgramPointTag *Tag = nullptr) {
202 return addTransitionImpl(State ? State : getState(), false, nullptr, Tag);
203 }
204
205 /// Generates a new transition with the given predecessor.
206 /// Allows checkers to generate a chain of nodes.
207 ///
208 /// @param State The state of the generated node.
209 /// @param Pred The transition will be generated from the specified Pred node
210 /// to the newly generated node.
211 /// @param Tag The tag to uniquely identify the creation site.
212 /// NOTE: If the State is unchanged and the Tag is nullptr, this may return a
213 /// node which is not tagged (instead of using the default tag corresponding
214 /// to the active checker). This is arguably a bug and should be fixed.
216 const ProgramPointTag *Tag = nullptr) {
217 return addTransitionImpl(State, false, Pred, Tag);
218 }
219
220 /// Generate a sink node. Generating a sink stops exploration of the
221 /// given path. To create a sink node for the purpose of reporting an error,
222 /// checkers should use generateErrorNode() instead.
224 const ProgramPointTag *Tag = nullptr) {
225 return addTransitionImpl(State ? State : getState(), true, Pred, Tag);
226 }
227
228 /// Add a sink node to the current path of execution, halting analysis.
229 void addSink(ProgramStateRef State = nullptr,
230 const ProgramPointTag *Tag = nullptr) {
231 if (!State)
232 State = getState();
233 addTransition(State, generateSink(State, getPredecessor()));
234 }
235
236 /// Generate a transition to a node that will be used to report
237 /// an error. This node will be a sink. That is, it will stop exploration of
238 /// the given path.
239 ///
240 /// @param State The state of the generated node.
241 /// @param Tag The tag to uniquely identify the creation site. If null,
242 /// the default tag for the checker will be used.
244 const ProgramPointTag *Tag = nullptr) {
245 return generateSink(State, Pred,
246 (Tag ? Tag : Location.getTag()));
247 }
248
249 /// Generate a transition to a node that will be used to report
250 /// an error. This node will be a sink. That is, it will stop exploration of
251 /// the given path.
252 ///
253 /// @param State The state of the generated node.
254 /// @param Pred The transition will be generated from the specified Pred node
255 /// to the newly generated node.
256 /// @param Tag The tag to uniquely identify the creation site. If null,
257 /// the default tag for the checker will be used.
259 ExplodedNode *Pred,
260 const ProgramPointTag *Tag = nullptr) {
261 return generateSink(State, Pred,
262 (Tag ? Tag : Location.getTag()));
263 }
264
265 /// Generate a transition to a node that will be used to report
266 /// an error. This node will not be a sink. That is, exploration will
267 /// continue along this path.
268 ///
269 /// @param State The state of the generated node.
270 /// @param Tag The tag to uniquely identify the creation site. If null,
271 /// the default tag for the checker will be used.
274 const ProgramPointTag *Tag = nullptr) {
275 return addTransition(State, (Tag ? Tag : Location.getTag()));
276 }
277
278 /// Generate a transition to a node that will be used to report
279 /// an error. This node will not be a sink. That is, exploration will
280 /// continue along this path.
281 ///
282 /// @param State The state of the generated node.
283 /// @param Pred The transition will be generated from the specified Pred node
284 /// to the newly generated node.
285 /// @param Tag The tag to uniquely identify the creation site. If null,
286 /// the default tag for the checker will be used.
289 ExplodedNode *Pred,
290 const ProgramPointTag *Tag = nullptr) {
291 return addTransition(State, Pred, (Tag ? Tag : Location.getTag()));
292 }
293
294 /// Emit the diagnostics report.
295 void emitReport(std::unique_ptr<BugReport> R) {
296 Changed = true;
297 Eng.getBugReporter().emitReport(std::move(R));
298 }
299
300 /// Produce a program point tag that displays an additional path note
301 /// to the user. This is a lightweight alternative to the
302 /// BugReporterVisitor mechanism: instead of visiting the bug report
303 /// node-by-node to restore the sequence of events that led to discovering
304 /// a bug, you can add notes as you add your transitions.
305 ///
306 /// @param Cb Callback with 'BugReporterContext &, BugReport &' parameters.
307 /// @param IsPrunable Whether the note is prunable. It allows BugReporter
308 /// to omit the note from the report if it would make the displayed
309 /// bug path significantly shorter.
310 LLVM_ATTRIBUTE_RETURNS_NONNULL
311 const NoteTag *getNoteTag(NoteTag::Callback &&Cb, bool IsPrunable = false) {
312 return Eng.getDataTags().make<NoteTag>(std::move(Cb), IsPrunable);
313 }
314
315 /// A shorthand version of getNoteTag that doesn't require you to accept
316 /// the 'BugReporterContext' argument when you don't need it.
317 ///
318 /// @param Cb Callback only with 'BugReport &' parameter.
319 /// @param IsPrunable Whether the note is prunable. It allows BugReporter
320 /// to omit the note from the report if it would make the displayed
321 /// bug path significantly shorter.
322 const NoteTag
324 bool IsPrunable = false) {
325 return getNoteTag(
326 [Cb](BugReporterContext &,
327 PathSensitiveBugReport &BR) { return Cb(BR); },
328 IsPrunable);
329 }
330
331 /// A shorthand version of getNoteTag that doesn't require you to accept
332 /// the arguments when you don't need it.
333 ///
334 /// @param Cb Callback without parameters.
335 /// @param IsPrunable Whether the note is prunable. It allows BugReporter
336 /// to omit the note from the report if it would make the displayed
337 /// bug path significantly shorter.
338 const NoteTag *getNoteTag(std::function<std::string()> &&Cb,
339 bool IsPrunable = false) {
340 return getNoteTag([Cb](BugReporterContext &,
341 PathSensitiveBugReport &) { return Cb(); },
342 IsPrunable);
343 }
344
345 /// A shorthand version of getNoteTag that accepts a plain note.
346 ///
347 /// @param Note The note.
348 /// @param IsPrunable Whether the note is prunable. It allows BugReporter
349 /// to omit the note from the report if it would make the displayed
350 /// bug path significantly shorter.
351 const NoteTag *getNoteTag(StringRef Note, bool IsPrunable = false) {
352 return getNoteTag(
353 [Note = std::string(Note)](BugReporterContext &,
354 PathSensitiveBugReport &) { return Note; },
355 IsPrunable);
356 }
357
358 /// A shorthand version of getNoteTag that accepts a lambda with stream for
359 /// note.
360 ///
361 /// @param Cb Callback with 'BugReport &' and 'llvm::raw_ostream &'.
362 /// @param IsPrunable Whether the note is prunable. It allows BugReporter
363 /// to omit the note from the report if it would make the displayed
364 /// bug path significantly shorter.
366 std::function<void(PathSensitiveBugReport &BR, llvm::raw_ostream &OS)> &&Cb,
367 bool IsPrunable = false) {
368 return getNoteTag(
369 [Cb](PathSensitiveBugReport &BR) -> std::string {
371 llvm::raw_svector_ostream OS(Str);
372 Cb(BR, OS);
373 return std::string(OS.str());
374 },
375 IsPrunable);
376 }
377
378 /// Returns the word that should be used to refer to the declaration
379 /// in the report.
380 StringRef getDeclDescription(const Decl *D);
381
382 /// Get the declaration of the called function (path-sensitive).
383 const FunctionDecl *getCalleeDecl(const CallExpr *CE) const;
384
385 /// Get the name of the called function (path-sensitive).
386 StringRef getCalleeName(const FunctionDecl *FunDecl) const;
387
388 /// Get the identifier of the called function (path-sensitive).
390 const FunctionDecl *FunDecl = getCalleeDecl(CE);
391 if (FunDecl)
392 return FunDecl->getIdentifier();
393 else
394 return nullptr;
395 }
396
397 /// Get the name of the called function (path-sensitive).
398 StringRef getCalleeName(const CallExpr *CE) const {
399 const FunctionDecl *FunDecl = getCalleeDecl(CE);
400 return getCalleeName(FunDecl);
401 }
402
403 /// Returns true if the given function is an externally-visible function in
404 /// the top-level namespace, such as \c malloc.
405 ///
406 /// If a name is provided, the function must additionally match the given
407 /// name.
408 ///
409 /// Note that this also accepts functions from the \c std namespace (because
410 /// headers like <cstdlib> declare them there) and does not check if the
411 /// function is declared as 'extern "C"' or if it uses C++ name mangling.
412 static bool isCLibraryFunction(const FunctionDecl *FD,
413 StringRef Name = StringRef());
414
415 /// In builds that use source hardening (-D_FORTIFY_SOURCE), many standard
416 /// functions are implemented as macros that expand to calls of hardened
417 /// functions that take additional arguments compared to the "usual"
418 /// variant and perform additional input validation. For example, a `memcpy`
419 /// call may expand to `__memcpy_chk()` or `__builtin___memcpy_chk()`.
420 ///
421 /// This method returns true if `FD` declares a fortified variant of the
422 /// standard library function `Name`.
423 ///
424 /// NOTE: This method relies on heuristics; extend it if you need to handle a
425 /// hardened variant that's not yet covered by it.
426 static bool isHardenedVariantOf(const FunctionDecl *FD, StringRef Name);
427
428 /// Depending on whether the location corresponds to a macro, return
429 /// either the macro name or the token spelling.
430 ///
431 /// This could be useful when checkers' logic depends on whether a function
432 /// is called with a given macro argument. For example:
433 /// s = socket(AF_INET,..)
434 /// If AF_INET is a macro, the result should be treated as a source of taint.
435 ///
436 /// \sa clang::Lexer::getSpelling(), clang::Lexer::getImmediateMacroName().
438
439private:
440 ExplodedNode *addTransitionImpl(ProgramStateRef State,
441 bool MarkAsSink,
442 ExplodedNode *P = nullptr,
443 const ProgramPointTag *Tag = nullptr) {
444 // The analyzer may stop exploring if it sees a state it has previously
445 // visited ("cache out"). The early return here is a defensive check to
446 // prevent accidental caching out by checker API clients. Unless there is a
447 // tag or the client checker has requested that the generated node be
448 // marked as a sink, we assume that a client requesting a transition to a
449 // state that is the same as the predecessor state has made a mistake. We
450 // return the predecessor rather than cache out.
451 //
452 // TODO: We could potentially change the return to an assertion to alert
453 // clients to their mistake, but several checkers (including
454 // DereferenceChecker, CallAndMessageChecker, and DynamicTypePropagation)
455 // rely upon the defensive behavior and would need to be updated.
456 if (!State || (State == Pred->getState() && !Tag && !MarkAsSink))
457 return Pred;
458
459 Changed = true;
460 const ProgramPoint &LocalLoc = (Tag ? Location.withTag(Tag) : Location);
461 if (!P)
462 P = Pred;
463
464 ExplodedNode *node;
465 if (MarkAsSink)
466 node = NB.generateSink(LocalLoc, State, P);
467 else
468 node = NB.generateNode(LocalLoc, State, P);
469 return node;
470 }
471};
472
473} // end GR namespace
474
475} // end clang namespace
476
477#endif
StringRef P
const Decl * D
Expr * E
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:188
const LangOptions & getLangOpts() const
Definition: ASTContext.h:894
AnalysisDeclContext contains the context data for the function, method or block under analysis.
unsigned getBlockID() const
Definition: CFG.h:1111
CallExpr - Represents a function call (C99 6.5.2.2, C++ [expr.call]).
Definition: Expr.h:2879
Decl - This represents one declaration (or definition), e.g.
Definition: DeclBase.h:86
This represents one expression.
Definition: Expr.h:112
Represents a function declaration or definition.
Definition: Decl.h:1999
One of these records is kept for each identifier that is lexed.
Keeps track of the various options that can be enabled, which controls the dialect of C or C++ that i...
Definition: LangOptions.h:434
It wraps the AnalysisDeclContext to represent both the call stack with the help of StackFrameContext ...
LLVM_ATTRIBUTE_RETURNS_NONNULL AnalysisDeclContext * getAnalysisDeclContext() const
virtual bool inTopFrame() const
IdentifierInfo * getIdentifier() const
Get the identifier that names this declaration, if there is one.
Definition: Decl.h:294
Represents a program point after a store evaluation.
Definition: ProgramPoint.h:436
Engages in a tight little dance with the lexer to efficiently preprocess tokens.
Definition: Preprocessor.h:145
ProgramPoints can be "tagged" as representing points specific to a given analysis entity.
Definition: ProgramPoint.h:38
const ProgramPointTag * getTag() const
Definition: ProgramPoint.h:179
ProgramPoint withTag(const ProgramPointTag *tag) const
Create a new ProgramPoint object that is the same as the original except for using the specified tag ...
Definition: ProgramPoint.h:135
std::optional< T > getAs() const
Convert to the specified ProgramPoint type, returning std::nullopt if this ProgramPoint is not of the...
Definition: ProgramPoint.h:153
Encodes a location in the source.
This class handles loading and caching of source files into memory.
It represents a stack frame of the call stack (based on CallEvent).
Stmt - This represents one statement.
Definition: Stmt.h:85
BugReporter is a utility class for generating PathDiagnostics for analysis.
Definition: BugReporter.h:586
Preprocessor & getPreprocessor()
Definition: BugReporter.h:630
const SourceManager & getSourceManager()
Definition: BugReporter.h:625
virtual void emitReport(std::unique_ptr< BugReport > R)
Add the given report to the set of reports tracked by BugReporter.
ExplodedNode * getPredecessor()
Returns the previous node in the exploded graph, which includes the state of the program before the c...
ExplodedNode * generateErrorNode(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
Generate a transition to a node that will be used to report an error.
const IdentifierInfo * getCalleeIdentifier(const CallExpr *CE) const
Get the identifier of the called function (path-sensitive).
static const MemRegion * getLocationRegionIfPostStore(const ExplodedNode *N)
If the given node corresponds to a PostStore program point, retrieve the location region as it was ut...
SymbolManager & getSymbolManager()
StringRef getDeclDescription(const Decl *D)
Returns the word that should be used to refer to the declaration in the report.
Preprocessor & getPreprocessor()
unsigned blockCount() const
Returns the number of times the current block has been visited along the analyzed path.
ExplodedNode * generateSink(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
Generate a sink node.
const SourceManager & getSourceManager()
SValBuilder & getSValBuilder()
CheckerContext(NodeBuilder &builder, ExprEngine &eng, ExplodedNode *pred, const ProgramPoint &loc, bool wasInlined=false)
const NoteTag * getNoteTag(std::function< std::string()> &&Cb, bool IsPrunable=false)
A shorthand version of getNoteTag that doesn't require you to accept the arguments when you don't nee...
StringRef getCalleeName(const FunctionDecl *FunDecl) const
Get the name of the called function (path-sensitive).
const NoteTag * getNoteTag(StringRef Note, bool IsPrunable=false)
A shorthand version of getNoteTag that accepts a plain note.
const ExplodedNode * getPredecessor() const
const SourceManager & getSourceManager() const
const StackFrameContext * getStackFrame() const
StringRef getCalleeName(const CallExpr *CE) const
Get the name of the called function (path-sensitive).
const ProgramStateRef & getState() const
ExplodedNode * addTransition(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generates a new transition in the program state graph (ExplodedGraph).
ConstraintManager & getConstraintManager()
SVal getSVal(const Stmt *S) const
Get the value of arbitrary expressions at this point in the path.
BugReporter & getBugReporter()
bool isDifferent()
Check if the checker changed the state of the execution; ex: added a new transition or a bug report.
ExplodedNode * addTransition(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
Generates a new transition with the given predecessor.
bool isNegative(const Expr *E)
Returns true if the value of E is negative.
const Preprocessor & getPreprocessor() const
const SValBuilder & getSValBuilder() const
AnalysisDeclContext * getCurrentAnalysisDeclContext() const
bool isGreaterOrEqual(const Expr *E, unsigned long long Val)
Returns true if the value of E is greater than or equal to Val under unsigned comparison.
const ProgramPoint getLocation() const
static bool isCLibraryFunction(const FunctionDecl *FD, StringRef Name=StringRef())
Returns true if the given function is an externally-visible function in the top-level namespace,...
ExplodedNode * generateNonFatalErrorNode(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generate a transition to a node that will be used to report an error.
LLVM_ATTRIBUTE_RETURNS_NONNULL const NoteTag * getNoteTag(NoteTag::Callback &&Cb, bool IsPrunable=false)
Produce a program point tag that displays an additional path note to the user.
const ASTContext & getASTContext() const
ConstCFGElementRef getCFGElementRef() const
AnalysisManager & getAnalysisManager()
ExplodedNode * generateErrorNode(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generate a transition to a node that will be used to report an error.
const FunctionDecl * getCalleeDecl(const CallExpr *CE) const
Get the declaration of the called function (path-sensitive).
void addSink(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Add a sink node to the current path of execution, halting analysis.
const SymbolManager & getSymbolManager() const
const NoteTag * getNoteTag(std::function< void(PathSensitiveBugReport &BR, llvm::raw_ostream &OS)> &&Cb, bool IsPrunable=false)
A shorthand version of getNoteTag that accepts a lambda with stream for note.
ProgramStateManager & getStateManager()
const ProgramStateManager & getStateManager() const
const StoreManager & getStoreManager() const
StringRef getMacroNameOrSpelling(SourceLocation &Loc)
Depending on whether the location corresponds to a macro, return either the macro name or the token s...
const LangOptions & getLangOpts() const
const BugReporter & getBugReporter() const
bool inTopFrame() const
Return true if the current LocationContext has no caller context.
const ConstraintManager & getConstraintManager() const
const LocationContext * getLocationContext() const
const bool wasInlined
If we are post visiting a call, this flag will be set if the call was inlined.
ExplodedNode * generateNonFatalErrorNode(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
Generate a transition to a node that will be used to report an error.
StoreManager & getStoreManager()
const NoteTag * getNoteTag(std::function< std::string(PathSensitiveBugReport &)> &&Cb, bool IsPrunable=false)
A shorthand version of getNoteTag that doesn't require you to accept the 'BugReporterContext' argumen...
const AnalysisManager & getAnalysisManager() const
static bool isHardenedVariantOf(const FunctionDecl *FD, StringRef Name)
In builds that use source hardening (-D_FORTIFY_SOURCE), many standard functions are implemented as m...
void emitReport(std::unique_ptr< BugReport > R)
Emit the diagnostics report.
unsigned getBlockID() const
Get the blockID.
const DataTagType * make(Args &&... ConstructorArgs)
Definition: BugReporter.h:771
const ProgramStateRef & getState() const
ProgramPoint getLocation() const
getLocation - Returns the edge associated with the given node.
const StackFrameContext * getStackFrame() const
SVal getSVal(const Stmt *S) const
Get the value of an arbitrary expression at this node.
const LocationContext * getLocationContext() const
ProgramStateManager & getStateManager()
Definition: ExprEngine.h:421
ASTContext & getContext() const
getContext - Return the ASTContext associated with this analysis.
Definition: ExprEngine.h:196
StoreManager & getStoreManager()
Definition: ExprEngine.h:424
BugReporter & getBugReporter()
Definition: ExprEngine.h:212
ConstCFGElementRef getCFGElementRef() const
Definition: ExprEngine.h:232
ConstraintManager & getConstraintManager()
Definition: ExprEngine.h:429
DataTag::Factory & getDataTags()
Definition: ExprEngine.h:445
AnalysisManager & getAnalysisManager()
Definition: ExprEngine.h:198
SValBuilder & getSValBuilder()
Definition: ExprEngine.h:209
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:98
const CFGBlock * getBlock() const
Return the CFGBlock associated with this builder.
Definition: CoreEngine.h:217
unsigned blockCount() const
Returns the number of times the current basic block has been visited on the exploded graph path.
Definition: CoreEngine.h:224
This is the simplest builder which generates nodes in the ExplodedGraph.
Definition: CoreEngine.h:240
ExplodedNode * generateNode(const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred)
Generates a node in the ExplodedGraph.
Definition: CoreEngine.h:293
ExplodedNode * generateSink(const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred)
Generates a sink in the ExplodedGraph.
Definition: CoreEngine.h:306
const NodeBuilderContext & getContext()
Definition: CoreEngine.h:332
The tag upon which the TagVisitor reacts.
Definition: BugReporter.h:786
std::function< std::string(BugReporterContext &, PathSensitiveBugReport &)> Callback
Definition: BugReporter.h:789
SymbolManager & getSymbolManager()
Definition: SValBuilder.h:165
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
Definition: SVals.h:56
@ OS
Indicates that the tracking object is a descendant of a referenced-counted OSObject,...
The JSON file list parser is used to communicate input to InstallAPI.
CFGBlock::ConstCFGElementRef ConstCFGElementRef
Definition: CFG.h:1199
int const char * function
Definition: c++config.h:31
#define false
Definition: stdbool.h:26