e39bd407ba
The analyzer trims unnecessary nodes from the exploded graph before reporting path diagnostics. However, in some cases it can trim all nodes (including the error node), leading to an assertion failure (see https://llvm.org/bugs/show_bug.cgi?id=24184). This commit addresses the issue by adding two new APIs to CheckerContext to explicitly create error nodes. Unless the client provides a custom tag, these APIs tag the node with the checker's tag -- preventing it from being trimmed. The generateErrorNode() method creates a sink error node, while generateNonFatalErrorNode() creates an error node for a path that should continue being explored. The intent is that one of these two methods should be used whenever a checker creates an error node. This commit updates the checkers to use these APIs. These APIs (unlike addTransition() and generateSink()) do not take an explicit Pred node. This is because there are not any error nodes in the checkers that were created with an explicit different than the default (the CheckerContext's Pred node). It also changes generateSink() to require state and pred nodes (previously these were optional) to reduce confusion. Additionally, there were several cases where checkers did check whether a generated node could be null; we now explicitly check for null in these places. This commit also includes a test case written by Ying Yi as part of http://reviews.llvm.org/D12163 (that patch originally addressed this issue but was reverted because it introduced false positive regressions). Differential Revision: http://reviews.llvm.org/D12780 llvm-svn: 247859
111 lines
3.6 KiB
C++
111 lines
3.6 KiB
C++
//=== UndefBranchChecker.cpp -----------------------------------*- C++ -*--===//
|
|
//
|
|
// The LLVM Compiler Infrastructure
|
|
//
|
|
// This file is distributed under the University of Illinois Open Source
|
|
// License. See LICENSE.TXT for details.
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
//
|
|
// This file defines UndefBranchChecker, which checks for undefined branch
|
|
// condition.
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
#include "ClangSACheckers.h"
|
|
#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
|
|
#include "clang/StaticAnalyzer/Core/Checker.h"
|
|
#include "clang/StaticAnalyzer/Core/CheckerManager.h"
|
|
#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
|
|
|
|
using namespace clang;
|
|
using namespace ento;
|
|
|
|
namespace {
|
|
|
|
class UndefBranchChecker : public Checker<check::BranchCondition> {
|
|
mutable std::unique_ptr<BuiltinBug> BT;
|
|
|
|
struct FindUndefExpr {
|
|
ProgramStateRef St;
|
|
const LocationContext *LCtx;
|
|
|
|
FindUndefExpr(ProgramStateRef S, const LocationContext *L)
|
|
: St(S), LCtx(L) {}
|
|
|
|
const Expr *FindExpr(const Expr *Ex) {
|
|
if (!MatchesCriteria(Ex))
|
|
return nullptr;
|
|
|
|
for (const Stmt *SubStmt : Ex->children())
|
|
if (const Expr *ExI = dyn_cast_or_null<Expr>(SubStmt))
|
|
if (const Expr *E2 = FindExpr(ExI))
|
|
return E2;
|
|
|
|
return Ex;
|
|
}
|
|
|
|
bool MatchesCriteria(const Expr *Ex) {
|
|
return St->getSVal(Ex, LCtx).isUndef();
|
|
}
|
|
};
|
|
|
|
public:
|
|
void checkBranchCondition(const Stmt *Condition, CheckerContext &Ctx) const;
|
|
};
|
|
|
|
}
|
|
|
|
void UndefBranchChecker::checkBranchCondition(const Stmt *Condition,
|
|
CheckerContext &Ctx) const {
|
|
SVal X = Ctx.getState()->getSVal(Condition, Ctx.getLocationContext());
|
|
if (X.isUndef()) {
|
|
// Generate a sink node, which implicitly marks both outgoing branches as
|
|
// infeasible.
|
|
ExplodedNode *N = Ctx.generateErrorNode();
|
|
if (N) {
|
|
if (!BT)
|
|
BT.reset(new BuiltinBug(
|
|
this, "Branch condition evaluates to a garbage value"));
|
|
|
|
// What's going on here: we want to highlight the subexpression of the
|
|
// condition that is the most likely source of the "uninitialized
|
|
// branch condition." We do a recursive walk of the condition's
|
|
// subexpressions and roughly look for the most nested subexpression
|
|
// that binds to Undefined. We then highlight that expression's range.
|
|
|
|
// Get the predecessor node and check if is a PostStmt with the Stmt
|
|
// being the terminator condition. We want to inspect the state
|
|
// of that node instead because it will contain main information about
|
|
// the subexpressions.
|
|
|
|
// Note: any predecessor will do. They should have identical state,
|
|
// since all the BlockEdge did was act as an error sink since the value
|
|
// had to already be undefined.
|
|
assert (!N->pred_empty());
|
|
const Expr *Ex = cast<Expr>(Condition);
|
|
ExplodedNode *PrevN = *N->pred_begin();
|
|
ProgramPoint P = PrevN->getLocation();
|
|
ProgramStateRef St = N->getState();
|
|
|
|
if (Optional<PostStmt> PS = P.getAs<PostStmt>())
|
|
if (PS->getStmt() == Ex)
|
|
St = PrevN->getState();
|
|
|
|
FindUndefExpr FindIt(St, Ctx.getLocationContext());
|
|
Ex = FindIt.FindExpr(Ex);
|
|
|
|
// Emit the bug report.
|
|
auto R = llvm::make_unique<BugReport>(*BT, BT->getDescription(), N);
|
|
bugreporter::trackNullOrUndefValue(N, Ex, *R);
|
|
R->addRange(Ex->getSourceRange());
|
|
|
|
Ctx.emitReport(std::move(R));
|
|
}
|
|
}
|
|
}
|
|
|
|
void ento::registerUndefBranchChecker(CheckerManager &mgr) {
|
|
mgr.registerChecker<UndefBranchChecker>();
|
|
}
|