Inheritance diagram for clang::ento::CheckerDocumentation:

Collaboration diagram for clang::ento::CheckerDocumentation:

Public Member Functions
void	checkPreStmt (const ReturnStmt *DS, CheckerContext &C) const
	Pre-visit the Statement.
void	checkPostStmt (const DeclStmt *DS, CheckerContext &C) const
	Post-visit the Statement.
void	checkPreObjCMessage (const ObjCMethodCall &M, CheckerContext &C) const
	Pre-visit the Objective C message.
void	checkPostObjCMessage (const ObjCMethodCall &M, CheckerContext &C) const
	Post-visit the Objective C message.
void	checkPreCall (const CallEvent &Call, CheckerContext &C) const
	Pre-visit an abstract "call" event.
void	checkPostCall (const CallEvent &Call, CheckerContext &C) const
	Post-visit an abstract "call" event.
void	checkBranchCondition (const Stmt *Condition, CheckerContext &Ctx) const
	Pre-visit of the condition statement of a branch (such as IfStmt).
void	checkLocation (SVal Loc, bool IsLoad, const Stmt *S, CheckerContext &) const
	Called on a load from and a store to a location.
void	checkBind (SVal Loc, SVal Val, const Stmt *S, CheckerContext &) const
	Called on binding of a value to a location.
void	checkDeadSymbols (SymbolReaper &SR, CheckerContext &C) const
	Called whenever a symbol becomes dead.
void	checkEndFunction (CheckerContext &Ctx) const
	Called when the analyzer core reaches the end of a function being analyzed.
void	checkEndAnalysis (ExplodedGraph &G, BugReporter &BR, ExprEngine &Eng) const
	Called after all the paths in the ExplodedGraph reach end of path.
void	checkEndOfTranslationUnit (const TranslationUnitDecl *TU, AnalysisManager &Mgr, BugReporter &BR) const
	Called after analysis of a TranslationUnit is complete.
bool	evalCall (const CallExpr *CE, CheckerContext &C) const
	Evaluates function call.
ProgramStateRef	evalAssume (ProgramStateRef State, SVal Cond, bool Assumption) const
	Handles assumptions on symbolic values.
void	checkLiveSymbols (ProgramStateRef State, SymbolReaper &SR) const
bool	wantsRegionChangeUpdate (ProgramStateRef St) const
	Called to determine if the checker currently needs to know if when contents of any regions change.
ProgramStateRef	checkRegionChanges (ProgramStateRef State, const InvalidatedSymbols Invalidated, ArrayRef< const MemRegion > ExplicitRegions, ArrayRef< const MemRegion * > Regions, const CallEvent *Call) const
	Called when the contents of one or more regions change.
ProgramStateRef	checkPointerEscape (ProgramStateRef State, const InvalidatedSymbols &Escaped, const CallEvent *Call, PointerEscapeKind Kind) const
	Called when pointers escape.
ProgramStateRef	checkConstPointerEscape (ProgramStateRef State, const InvalidatedSymbols &Escaped, const CallEvent *Call, PointerEscapeKind Kind) const
	Called when const pointers escape.
void	checkEvent (ImplicitNullDerefEvent Event) const
	check::Event<ImplicitNullDerefEvent>
void	checkASTDecl (const FunctionDecl *D, AnalysisManager &Mgr, BugReporter &BR) const
	Check every declaration in the AST.

Detailed Description

This checker documents the callback functions checkers can use to implement the custom handling of the specific events during path exploration as well as reporting bugs. Most of the callbacks are targeted at path-sensitive checking.

See also:: CheckerContext

Definition at line 37 of file CheckerDocumentation.cpp.

Member Function Documentation

void clang::ento::CheckerDocumentation::checkASTDecl	(	const FunctionDecl *	D,
		AnalysisManager &	Mgr,
		BugReporter &	BR
	)		const `[inline]`

Check every declaration in the AST.

An AST traversal callback, which should only be used when the checker is not path sensitive. It will be called for every Declaration in the AST and can be specialized to only be called on subclasses of Decl, for example, FunctionDecl.

check::ASTDecl<FunctionDecl>

Definition at line 300 of file CheckerDocumentation.cpp.

void clang::ento::CheckerDocumentation::checkBind	(	SVal	Loc,
		SVal	Val,
		const Stmt *	S,
		CheckerContext &
	)		const `[inline]`

Called on binding of a value to a location.

Parameters:

Loc	The value of the location (pointer).
Val	The value which will be stored at the location Loc.
S	The bind is performed while processing the statement S.

check::Bind

Definition at line 138 of file CheckerDocumentation.cpp.

void clang::ento::CheckerDocumentation::checkBranchCondition	(	const Stmt *	Condition,
		CheckerContext &	Ctx
	)		const `[inline]`

Pre-visit of the condition statement of a branch (such as IfStmt).

Definition at line 117 of file CheckerDocumentation.cpp.

ProgramStateRef clang::ento::CheckerDocumentation::checkConstPointerEscape	(	ProgramStateRef	State,
		const InvalidatedSymbols &	Escaped,
		const CallEvent *	Call,
		PointerEscapeKind	Kind
	)		const `[inline]`

Called when const pointers escape.

Note: in most cases checkPointerEscape callback is sufficient.

See also:: checkPointerEscape

Definition at line 282 of file CheckerDocumentation.cpp.

References State.

void clang::ento::CheckerDocumentation::checkDeadSymbols	(	SymbolReaper &	SR,
		CheckerContext &	C
	)		const `[inline]`

Called whenever a symbol becomes dead.

This callback should be used by the checkers to aggressively clean up/reduce the checker state, which is important for reducing the overall memory usage. Specifically, if a checker keeps symbol specific information in the sate, it can and should be dropped after the symbol becomes dead. In addition, reporting a bug as soon as the checker becomes dead leads to more precise diagnostics. (For example, one should report that a malloced variable is not freed right after it goes out of scope.)

Parameters:

SR	The SymbolReaper object can be queried to determine which symbols are dead.

check::DeadSymbols

Definition at line 155 of file CheckerDocumentation.cpp.

void clang::ento::CheckerDocumentation::checkEndAnalysis	(	ExplodedGraph &	G,
		BugReporter &	BR,
		ExprEngine &	Eng
	)		const `[inline]`

Called after all the paths in the ExplodedGraph reach end of path.

the symbolic execution graph is fully explored.

This callback should be used in cases when a checker needs to have a global view of the information generated on all paths. For example, to compare execution summary/result several paths. See IdempotentOperationChecker for a usage example.

check::EndAnalysis

Definition at line 172 of file CheckerDocumentation.cpp.

void clang::ento::CheckerDocumentation::checkEndFunction ( CheckerContext & Ctx ) const [inline]

Called when the analyzer core reaches the end of a function being analyzed.

check::EndFunction

Definition at line 161 of file CheckerDocumentation.cpp.

void clang::ento::CheckerDocumentation::checkEndOfTranslationUnit	(	const TranslationUnitDecl *	TU,
		AnalysisManager &	Mgr,
		BugReporter &	BR
	)		const `[inline]`

Called after analysis of a TranslationUnit is complete.

check::EndOfTranslationUnit

Definition at line 179 of file CheckerDocumentation.cpp.

void clang::ento::CheckerDocumentation::checkEvent ( ImplicitNullDerefEvent Event ) const [inline]

check::Event<ImplicitNullDerefEvent>

Definition at line 290 of file CheckerDocumentation.cpp.

void clang::ento::CheckerDocumentation::checkLiveSymbols	(	ProgramStateRef	State,
		SymbolReaper &	SR
	)		const `[inline]`

Allows modifying SymbolReaper object. For example, checkers can explicitly register symbols of interest as live. These symbols will not be marked dead and removed.

check::LiveSymbols

Definition at line 216 of file CheckerDocumentation.cpp.

void clang::ento::CheckerDocumentation::checkLocation	(	SVal	Loc,
		bool	IsLoad,
		const Stmt *	S,
		CheckerContext &
	)		const `[inline]`

Called on a load from and a store to a location.

The method will be called each time a location (pointer) value is accessed.

Parameters:

Loc	The value of the location (pointer).
IsLoad	The flag specifying if the location is a store or a load.
S	The load is performed while processing the statement.

check::Location

Definition at line 128 of file CheckerDocumentation.cpp.

ProgramStateRef clang::ento::CheckerDocumentation::checkPointerEscape	(	ProgramStateRef	State,
		const InvalidatedSymbols &	Escaped,
		const CallEvent *	Call,
		PointerEscapeKind	Kind
	)		const `[inline]`

Called when pointers escape.

This notifies the checkers about pointer escape, which occurs whenever the analyzer cannot track the symbol any more. For example, as a result of assigning a pointer into a global or when it's passed to a function call the analyzer cannot model.

Parameters:

State	The state at the point of escape.
Escaped	The list of escaped symbols.
Call	The corresponding CallEvent, if the symbols escape as parameters to the given call.
Kind	How the symbols have escaped.

Returns:: Checkers can modify the state by returning a new state.

Definition at line 271 of file CheckerDocumentation.cpp.

References State.

void clang::ento::CheckerDocumentation::checkPostCall	(	const CallEvent &	Call,
		CheckerContext &	C
	)		const `[inline]`

Post-visit an abstract "call" event.

See also:: checkPreObjCMessage()

check::PostCall

Definition at line 114 of file CheckerDocumentation.cpp.

void clang::ento::CheckerDocumentation::checkPostObjCMessage	(	const ObjCMethodCall &	M,
		CheckerContext &	C
	)		const `[inline]`

Post-visit the Objective C message.

See also:: checkPreObjCMessage()

check::PostObjCMessage

Definition at line 96 of file CheckerDocumentation.cpp.

void clang::ento::CheckerDocumentation::checkPostStmt	(	const DeclStmt *	DS,
		CheckerContext &	C
	)		const

Post-visit the Statement.

The method will be called after the analyzer core processes the statement. The notification is performed for every explored CFGElement, which does not include the control flow statements such as IfStmt. The callback can be specialized to be called with any subclass of Stmt.

check::PostStmt<DeclStmt>

Definition at line 306 of file CheckerDocumentation.cpp.

void clang::ento::CheckerDocumentation::checkPreCall	(	const CallEvent &	Call,
		CheckerContext &	C
	)		const `[inline]`

Pre-visit an abstract "call" event.

This is used for checkers that want to check arguments or attributed behavior for functions and methods no matter how they are being invoked.

Note that this includes ALL cross-body invocations, so if you want to limit your checks to, say, function calls, you should test for that at the beginning of your callback function.

check::PreCall

Definition at line 108 of file CheckerDocumentation.cpp.

void clang::ento::CheckerDocumentation::checkPreObjCMessage	(	const ObjCMethodCall &	M,
		CheckerContext &	C
	)		const `[inline]`

Pre-visit the Objective C message.

This will be called before the analyzer core processes the method call. This is called for any action which produces an Objective-C message send, including explicit message syntax and property access.

check::PreObjCMessage

Definition at line 90 of file CheckerDocumentation.cpp.

void clang::ento::CheckerDocumentation::checkPreStmt	(	const ReturnStmt *	DS,
		CheckerContext &	C
	)		const `[inline]`

Pre-visit the Statement.

The method will be called before the analyzer core processes the statement. The notification is performed for every explored CFGElement, which does not include the control flow statements such as IfStmt. The callback can be specialized to be called with any subclass of Stmt.

See checkBranchCondition() callback for performing custom processing of the branching statements.

check::PreStmt<ReturnStmt>

Definition at line 71 of file CheckerDocumentation.cpp.

ProgramStateRef clang::ento::CheckerDocumentation::checkRegionChanges	(	ProgramStateRef	State,
		const InvalidatedSymbols *	Invalidated,
		ArrayRef< const MemRegion * >	ExplicitRegions,
		ArrayRef< const MemRegion * >	Regions,
		const CallEvent *	Call
	)		const `[inline]`

Called when the contents of one or more regions change.

This can occur in many different ways: an explicit bind, a blanket invalidation of the region contents, or by passing a region to a function call whose behavior the analyzer cannot model perfectly.

Parameters:

State	The current program state.
Invalidated	A set of all symbols potentially touched by the change.
ExplicitRegions	The regions explicitly requested for invalidation. For a function call, this would be the arguments. For a bind, this would be the region being bound to.
Regions	The transitive closure of regions accessible from, `ExplicitRegions`, i.e. all regions that may have been touched by this change. For a simple bind, this list will be the same as `ExplicitRegions`, since a bind does not affect the contents of anything accessible through the base region.
Call	The opaque call triggering this invalidation. Will be 0 if the change was not triggered by a call.

Note that this callback will not be invoked unless wantsRegionChangeUpdate returns true.

check::RegionChanges

Definition at line 250 of file CheckerDocumentation.cpp.

References State.

ProgramStateRef clang::ento::CheckerDocumentation::evalAssume	(	ProgramStateRef	State,
		SVal	Cond,
		bool	Assumption
	)		const `[inline]`

Handles assumptions on symbolic values.

This method is called when a symbolic expression is assumed to be true or false. For example, the assumptions are performed when evaluating a condition at a branch. The callback allows checkers track the assumptions performed on the symbols of interest and change the state accordingly.

eval::Assume

Definition at line 207 of file CheckerDocumentation.cpp.

References State.

bool clang::ento::CheckerDocumentation::evalCall	(	const CallExpr *	CE,
		CheckerContext &	C
	)		const `[inline]`

Evaluates function call.

The analysis core threats all function calls in the same way. However, some functions have special meaning, which should be reflected in the program state. This callback allows a checker to provide domain specific knowledge about the particular functions it knows about.

Returns:: true if the call has been successfully evaluated and false otherwise. Note, that only one checker can evaluate a call. If more than one checker claims that they can evaluate the same call the first one wins.

eval::Call

Definition at line 197 of file CheckerDocumentation.cpp.

bool clang::ento::CheckerDocumentation::wantsRegionChangeUpdate ( ProgramStateRef St ) const [inline]

Called to determine if the checker currently needs to know if when contents of any regions change.

Since it is not necessarily cheap to compute which regions are being changed, this allows the analyzer core to skip the more expensive checkRegionChanges when no checkers are tracking any state.

Definition at line 224 of file CheckerDocumentation.cpp.

The documentation for this class was generated from the following file:

CheckerDocumentation.cpp

Public Member Functions

Detailed Description

Member Function Documentation