class CheckerContext

Declaration

class CheckerContext { /* full declaration omitted */ };

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:23

Member Variables

private clang::ento::ExprEngine& Eng

private clang::ento::ExplodedNode* Pred

The current exploded(symbolic execution) graph node.

private bool Changed

The flag is true if the (state of the execution) has been modified by the checker using this context. For example, a new transition has been added or a bug report issued.

private const clang::ProgramPoint Location

The tagged location, which is used to generate all new nodes.

private clang::ento::NodeBuilder& NB

public const bool wasInlined

If we are post visiting a call, this flag will be set if the call was inlined. In all other cases it will be false.

Method Overview

• public CheckerContext(clang::ento::NodeBuilder & builder, clang::ento::ExprEngine & eng, clang::ento::ExplodedNode * pred, const clang::ProgramPoint & loc, bool wasInlined = false)
• public void addSink(clang::ento::ProgramStateRef State = nullptr, const clang::ProgramPointTag * Tag = nullptr)
• public clang::ento::ExplodedNode * addTransition(clang::ento::ProgramStateRef State, clang::ento::ExplodedNode * Pred, const clang::ProgramPointTag * Tag = nullptr)
• public clang::ento::ExplodedNode * addTransition(clang::ento::ProgramStateRef State = nullptr, const clang::ProgramPointTag * Tag = nullptr)
• private clang::ento::ExplodedNode * addTransitionImpl(clang::ento::ProgramStateRef State, bool MarkAsSink, clang::ento::ExplodedNode * P = nullptr, const clang::ProgramPointTag * Tag = nullptr)
• public unsigned int blockCount() const
• public void emitReport(std::unique_ptr<BugReport> R)
• public clang::ento::ExplodedNode * generateErrorNode(clang::ento::ProgramStateRef State = nullptr, const clang::ProgramPointTag * Tag = nullptr)
• public clang::ento::ExplodedNode * generateNonFatalErrorNode(clang::ento::ProgramStateRef State, clang::ento::ExplodedNode * Pred, const clang::ProgramPointTag * Tag = nullptr)
• public clang::ento::ExplodedNode * generateNonFatalErrorNode(clang::ento::ProgramStateRef State = nullptr, const clang::ProgramPointTag * Tag = nullptr)
• public clang::ento::ExplodedNode * generateSink(clang::ento::ProgramStateRef State, clang::ento::ExplodedNode * Pred, const clang::ProgramPointTag * Tag = nullptr)
• public clang::ASTContext & getASTContext()
• public const clang::ASTContext & getASTContext() const
• public clang::ento::AnalysisManager & getAnalysisManager()
• public unsigned int getBlockID() const
• public clang::ento::BugReporter & getBugReporter()
• public const clang::FunctionDecl * getCalleeDecl(const clang::CallExpr * CE) const
• public const clang::IdentifierInfo * getCalleeIdentifier(const clang::CallExpr * CE) const
• public llvm::StringRef getCalleeName(const clang::CallExpr * CE) const
• public llvm::StringRef getCalleeName(const clang::FunctionDecl * FunDecl) const
• public clang::ento::ConstraintManager & getConstraintManager()
• public clang::AnalysisDeclContext * getCurrentAnalysisDeclContext() const
• public llvm::StringRef getDeclDescription(const clang::Decl * D)
• public const clang::LangOptions & getLangOpts() const
• public const clang::LocationContext * getLocationContext() const
• public static const clang::ento::MemRegion * getLocationRegionIfPostStore(const clang::ento::ExplodedNode * N)
• public llvm::StringRef getMacroNameOrSpelling(clang::SourceLocation & Loc)
• public const clang::ento::NoteTag * getNoteTag(std::function<std::string ()> && Cb, bool IsPrunable = false)
• public const clang::ento::NoteTag * getNoteTag(std::function<std::string (PathSensitiveBugReport &)> && Cb, bool IsPrunable = false)
• public const clang::ento::NoteTag * getNoteTag(NoteTag::Callback && Cb, bool IsPrunable = false)
• public const clang::ento::NoteTag * getNoteTag(llvm::StringRef Note, bool IsPrunable = false)
• public const clang::ento::NoteTag * getNoteTag(std::function<void (PathSensitiveBugReport &, llvm::raw_ostream &)> && Cb, bool IsPrunable = false)
• public clang::ento::ExplodedNode * getPredecessor()
• public clang::Preprocessor & getPreprocessor()
• public clang::ento::SVal getSVal(const clang::Stmt * S) const
• public clang::ento::SValBuilder & getSValBuilder()
• public const clang::SourceManager & getSourceManager()
• public const clang::StackFrameContext * getStackFrame() const
• public const clang::ento::ProgramStateRef & getState() const
• public clang::ento::ProgramStateManager & getStateManager()
• public clang::ento::StoreManager & getStoreManager()
• public clang::ento::SymbolManager & getSymbolManager()
• public bool inTopFrame() const
• public static bool isCLibraryFunction(const clang::FunctionDecl * FD, llvm::StringRef Name = llvm::StringRef())
• public bool isDifferent()
• public bool isGreaterOrEqual(const clang::Expr * E, unsigned long long Val)
• public bool isNegative(const clang::Expr * E)

Methods

¶CheckerContext(clang::ento::NodeBuilder& builder,
               clang::ento::ExprEngine& eng,
               clang::ento::ExplodedNode* pred,
               const clang::ProgramPoint& loc,
               bool wasInlined = false)

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:40

Parameters

clang::ento::NodeBuilder& builder

clang::ento::ExprEngine& eng

clang::ento::ExplodedNode* pred

const clang::ProgramPoint& loc

bool wasInlined = false

¶void addSink(
    clang::ento::ProgramStateRef State = nullptr,
    const clang::ProgramPointTag* Tag = nullptr)

Description

Add a sink node to the current path of execution, halting analysis.

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:194

Parameters

clang::ento::ProgramStateRef State = nullptr

const clang::ProgramPointTag* Tag = nullptr

¶clang::ento::ExplodedNode* addTransition(
    clang::ento::ProgramStateRef State,
    clang::ento::ExplodedNode* Pred,
    const clang::ProgramPointTag* Tag = nullptr)

Description

Generates a new transition with the given predecessor. Allows checkers to generate a chain of nodes.

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:180

Parameters

clang::ento::ProgramStateRef State

The state of the generated node.

clang::ento::ExplodedNode* Pred

The transition will be generated from the specified Pred node to the newly generated node.

const clang::ProgramPointTag* Tag = nullptr

The tag to uniquely identify the creation site.

¶clang::ento::ExplodedNode* addTransition(
    clang::ento::ProgramStateRef State = nullptr,
    const clang::ProgramPointTag* Tag = nullptr)

Description

Generates a new transition in the program state graph (ExplodedGraph). Uses the default CheckerContext predecessor node.

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:168

Parameters

clang::ento::ProgramStateRef State = nullptr

The state of the generated node. If not specified, the state will not be changed, but the new node will have the checker's tag.

const clang::ProgramPointTag* Tag = nullptr

The tag is used to uniquely identify the creation site. If no tag is specified, a default tag, unique to the given checker, will be used. Tags are used to prevent states generated at different sites from caching out.

¶clang::ento::ExplodedNode* addTransitionImpl(
    clang::ento::ProgramStateRef State,
    bool MarkAsSink,
    clang::ento::ExplodedNode* P = nullptr,
    const clang::ProgramPointTag* Tag = nullptr)

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:377

Parameters

clang::ento::ProgramStateRef State

bool MarkAsSink

clang::ento::ExplodedNode* P = nullptr

const clang::ProgramPointTag* Tag = nullptr

¶unsigned int blockCount() const

Description

Returns the number of times the current block has been visited along the analyzed path.

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:79

¶void emitReport(std::unique_ptr<BugReport> R)

Description

Emit the diagnostics report.

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:244

Parameters

std::unique_ptr<BugReport> R

¶clang::ento::ExplodedNode* generateErrorNode(
    clang::ento::ProgramStateRef State = nullptr,
    const clang::ProgramPointTag* Tag = nullptr)

Description

Generate a transition to a node that will be used to report an error. This node will be a sink. That is, it will stop exploration of the given path.

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:208

Parameters

clang::ento::ProgramStateRef State = nullptr

The state of the generated node.

const clang::ProgramPointTag* Tag = nullptr

The tag to uniquely identify the creation site. If null, the default tag for the checker will be used.

¶clang::ento::ExplodedNode*
generateNonFatalErrorNode(
    clang::ento::ProgramStateRef State,
    clang::ento::ExplodedNode* Pred,
    const clang::ProgramPointTag* Tag = nullptr)

Description

Generate a transition to a node that will be used to report an error. This node will not be a sink. That is, exploration will continue along this path.

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:237

Parameters

clang::ento::ProgramStateRef State

The state of the generated node.

clang::ento::ExplodedNode* Pred

The transition will be generated from the specified Pred node to the newly generated node.

const clang::ProgramPointTag* Tag = nullptr

The tag to uniquely identify the creation site. If null, the default tag for the checker will be used.

¶clang::ento::ExplodedNode*
generateNonFatalErrorNode(
    clang::ento::ProgramStateRef State = nullptr,
    const clang::ProgramPointTag* Tag = nullptr)

Description

Generate a transition to a node that will be used to report an error. This node will not be a sink. That is, exploration will continue along this path.

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:222

Parameters

clang::ento::ProgramStateRef State = nullptr

The state of the generated node.

const clang::ProgramPointTag* Tag = nullptr

The tag to uniquely identify the creation site. If null, the default tag for the checker will be used.

¶clang::ento::ExplodedNode* generateSink(
    clang::ento::ProgramStateRef State,
    clang::ento::ExplodedNode* Pred,
    const clang::ProgramPointTag* Tag = nullptr)

Description

Generate a sink node. Generating a sink stops exploration of the given path. To create a sink node for the purpose of reporting an error, checkers should use generateErrorNode() instead.

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:188

Parameters

clang::ento::ProgramStateRef State

clang::ento::ExplodedNode* Pred

const clang::ProgramPointTag* Tag = nullptr

¶clang::ASTContext& getASTContext()

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:83

¶const clang::ASTContext& getASTContext() const

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:87

¶clang::ento::AnalysisManager& getAnalysisManager()

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:55

¶unsigned int getBlockID() const

Description

Get the blockID.

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:131

¶clang::ento::BugReporter& getBugReporter()

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:104

¶const clang::FunctionDecl* getCalleeDecl(
    const clang::CallExpr* CE) const

Description

Get the declaration of the called function (path-sensitive).

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:332

Parameters

const clang::CallExpr* CE

¶const clang::IdentifierInfo* getCalleeIdentifier(
    const clang::CallExpr* CE) const

Description

Get the identifier of the called function (path-sensitive).

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:338

Parameters

const clang::CallExpr* CE

¶llvm::StringRef getCalleeName(
    const clang::CallExpr* CE) const

Description

Get the name of the called function (path-sensitive).

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:347

Parameters

const clang::CallExpr* CE

¶llvm::StringRef getCalleeName(
    const clang::FunctionDecl* FunDecl) const

Description

Get the name of the called function (path-sensitive).

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:335

Parameters

const clang::FunctionDecl* FunDecl

¶clang::ento::ConstraintManager&
getConstraintManager()

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:59

¶clang::AnalysisDeclContext*
getCurrentAnalysisDeclContext() const

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:126

¶llvm::StringRef getDeclDescription(
    const clang::Decl* D)

Description

Returns the word that should be used to refer to the declaration in the report.

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:329

Parameters

const clang::Decl* D

¶const clang::LangOptions& getLangOpts() const

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:89

¶const clang::LocationContext* getLocationContext()
    const

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:93

¶static const clang::ento::MemRegion*
getLocationRegionIfPostStore(
    const clang::ento::ExplodedNode* N)

Description

If the given node corresponds to a PostStore program point, retrieve the location region as it was uttered in the code. This utility can be useful for generating extensive diagnostics, for example, for finding variables that the given symbol was assigned to.

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:140

Parameters

const clang::ento::ExplodedNode* N

¶llvm::StringRef getMacroNameOrSpelling(
    clang::SourceLocation& Loc)

Description

Depending on wither the location corresponds to a macro, return either the macro name or the token spelling. This could be useful when checkers' logic depends on whether a function is called with a given macro argument. For example: s = socket(AF_INET,..) If AF_INET is a macro, the result should be treated as a source of taint.

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:374

Parameters

clang::SourceLocation& Loc

¶const clang::ento::NoteTag* getNoteTag(
    std::function<std::string()>&& Cb,
    bool IsPrunable = false)

Description

A shorthand version of getNoteTag that doesn't require you to accept the arguments when you don't need it.

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:287

Parameters

std::function<std::string()>&& Cb

Callback without parameters.

bool IsPrunable = false

Whether the note is prunable. It allows BugReporter to omit the note from the report if it would make the displayed bug path significantly shorter.

¶const clang::ento::NoteTag* getNoteTag(
    std::function<std::string(
        PathSensitiveBugReport&)>&& Cb,
    bool IsPrunable = false)

Description

A shorthand version of getNoteTag that doesn't require you to accept the 'BugReporterContext' argument when you don't need it.

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:272

Parameters

std::function<std::string( PathSensitiveBugReport&)>&& Cb

Callback only with 'BugReport & ' parameter.

bool IsPrunable = false

Whether the note is prunable. It allows BugReporter to omit the note from the report if it would make the displayed bug path significantly shorter.

¶const clang::ento::NoteTag* getNoteTag(
    NoteTag::Callback&& Cb,
    bool IsPrunable = false)

Description

Produce a program point tag that displays an additional path note to the user. This is a lightweight alternative to the BugReporterVisitor mechanism: instead of visiting the bug report node-by-node to restore the sequence of events that led to discovering a bug, you can add notes as you add your transitions.

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:260

Parameters

NoteTag::Callback&& Cb

Callback with 'BugReporterContext & , BugReport & ' parameters.

bool IsPrunable = false

Whether the note is prunable. It allows BugReporter to omit the note from the report if it would make the displayed bug path significantly shorter.

¶const clang::ento::NoteTag* getNoteTag(
    llvm::StringRef Note,
    bool IsPrunable = false)

Description

A shorthand version of getNoteTag that accepts a plain note.

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:300

Parameters

llvm::StringRef Note

The note.

bool IsPrunable = false

Whether the note is prunable. It allows BugReporter to omit the note from the report if it would make the displayed bug path significantly shorter.

¶const clang::ento::NoteTag* getNoteTag(
    std::function<void(PathSensitiveBugReport&,
                       llvm::raw_ostream&)>&& Cb,
    bool IsPrunable = false)

Description

A shorthand version of getNoteTag that accepts a lambda with stream for note.

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:314

Parameters

std::function<void(PathSensitiveBugReport&, llvm::raw_ostream&)>&& Cb

Callback with 'BugReport & ' and 'llvm::raw_ostream & '.

bool IsPrunable = false

Whether the note is prunable. It allows BugReporter to omit the note from the report if it would make the displayed bug path significantly shorter.

¶clang::ento::ExplodedNode* getPredecessor()

Description

Returns the previous node in the exploded graph, which includes the state of the program before the checker ran. Note, checkers should not retain the node in their state since the nodes might get invalidated.

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:70

¶clang::Preprocessor& getPreprocessor()

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:112

¶clang::ento::SVal getSVal(
    const clang::Stmt* S) const

Description

Get the value of arbitrary expressions at this point in the path.

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:148

Parameters

const clang::Stmt* S

¶clang::ento::SValBuilder& getSValBuilder()

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:114

¶const clang::SourceManager& getSourceManager()

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:108

¶const clang::StackFrameContext* getStackFrame()
    const

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:97

¶const clang::ento::ProgramStateRef& getState()
    const

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:71

¶clang::ento::ProgramStateManager&
getStateManager()

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:122

¶clang::ento::StoreManager& getStoreManager()

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:63

¶clang::ento::SymbolManager& getSymbolManager()

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:118

¶bool inTopFrame() const

Description

Return true if the current LocationContext has no caller context.

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:102

¶static bool isCLibraryFunction(
    const clang::FunctionDecl* FD,
    llvm::StringRef Name = llvm::StringRef())

Description

Returns true if the callee is an externally-visible function in the top-level namespace, such as \c malloc. If a name is provided, the function must additionally match the given name. Note that this deliberately excludes C++ library functions in the \c std namespace, but will include C library functions accessed through the\c std namespace. This also does not check if the function is declared as 'extern "C"', or if it uses C++ name mangling.

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:362

Parameters

const clang::FunctionDecl* FD

llvm::StringRef Name = llvm::StringRef()

¶bool isDifferent()

Description

Check if the checker changed the state of the execution; ex: added a new transition or a bug report.

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:75

¶bool isGreaterOrEqual(const clang::Expr* E,
                      unsigned long long Val)

Description

Returns true if the value of \p E is greater than or equal to \p Val under unsigned comparison

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:154

Parameters

const clang::Expr* E

unsigned long long Val

¶bool isNegative(const clang::Expr* E)

Description

Returns true if the value of \p E is negative.

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h:157

Parameters

const clang::Expr* E