dnrops
/
clang
mirror of https://github.com/microsoft/clang.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[analyzer] introduce getSVal(Stmt *) helper on ExplodedNode, make sure the helper is used consistently 

In most cases using
`N->getState()->getSVal(E, N->getLocationContext())`
is ugly, verbose, and also opens up more surface area for bugs if an
inconsistent location context is used.

This patch introduces a helper on an exploded node, and ensures
consistent usage of either `ExplodedNode::getSVal` or
`CheckContext::getSVal` across the codebase.
As a result, a large number of redundant lines is removed.

Differential Revision: https://reviews.llvm.org/D42155

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@322753 91177308-0d34-0410-b5e6-96231b3b80d8
This commit is contained in:
George Karpenkov 2018-01-17 20:27:29 +00:00
parent 8d0e1351b8
commit b340ee9768
39 changed files with 115 additions and 164 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
examples/analyzer-plugin/MainCallChecker.cpp
View File

@ -16,10 +16,8 @@ public:
} // end anonymous namespace } // end anonymous namespace
void MainCallChecker::checkPreStmt(const CallExpr *CE, CheckerContext &C) const { void MainCallChecker::checkPreStmt(const CallExpr *CE, CheckerContext &C) const {
const ProgramStateRef state = C.getState();
const LocationContext *LC = C.getLocationContext();
const Expr *Callee = CE->getCallee(); const Expr *Callee = CE->getCallee();
const FunctionDecl *FD = state->getSVal(Callee, LC).getAsFunctionDecl(); const FunctionDecl *FD = C.getSVal(Callee).getAsFunctionDecl();
if (!FD) if (!FD)
return; return;

2
include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h
View File

@ -193,7 +193,7 @@ public:
/// \brief Get the value of arbitrary expressions at this point in the path. /// \brief Get the value of arbitrary expressions at this point in the path.
SVal getSVal(const Stmt *S) const { SVal getSVal(const Stmt *S) const {
return getState()->getSVal(S, getLocationContext()); return Pred->getSVal(S);
} }
/// \brief Returns true if the value of \p E is greater than or equal to \p /// \brief Returns true if the value of \p E is greater than or equal to \p

5
include/clang/StaticAnalyzer/Core/PathSensitive/ExplodedGraph.h
View File

@ -156,6 +156,11 @@ public:
return Location.getAs<T>(); return Location.getAs<T>();
} }
/// Get the value of an arbitrary expression at this node.
SVal getSVal(const Stmt *S) const {
return getState()->getSVal(S, getLocationContext());
}
static void Profile(llvm::FoldingSetNodeID &ID, static void Profile(llvm::FoldingSetNodeID &ID,
const ProgramPoint &Loc, const ProgramPoint &Loc,
const ProgramStateRef &state, const ProgramStateRef &state,

12
lib/StaticAnalyzer/Checkers/BasicObjCFoundationChecks.cpp
View File

@ -436,8 +436,7 @@ void CFNumberChecker::checkPreStmt(const CallExpr *CE,
return; return;
// Get the value of the "theType" argument. // Get the value of the "theType" argument.
const LocationContext *LCtx = C.getLocationContext(); SVal TheTypeVal = C.getSVal(CE->getArg(1));
SVal TheTypeVal = state->getSVal(CE->getArg(1), LCtx);
// FIXME: We really should allow ranges of valid theType values, and // FIXME: We really should allow ranges of valid theType values, and
// bifurcate the state appropriately. // bifurcate the state appropriately.
@ -457,7 +456,7 @@ void CFNumberChecker::checkPreStmt(const CallExpr *CE,
// Look at the value of the integer being passed by reference. Essentially // Look at the value of the integer being passed by reference. Essentially
// we want to catch cases where the value passed in is not equal to the // we want to catch cases where the value passed in is not equal to the
// size of the type being created. // size of the type being created.
SVal TheValueExpr = state->getSVal(CE->getArg(2), LCtx); SVal TheValueExpr = C.getSVal(CE->getArg(2));
// FIXME: Eventually we should handle arbitrary locations. We can do this // FIXME: Eventually we should handle arbitrary locations. We can do this
// by having an enhanced memory model that does low-level typing. // by having an enhanced memory model that does low-level typing.
@ -571,7 +570,7 @@ void CFRetainReleaseChecker::checkPreStmt(const CallExpr *CE,
// Get the argument's value. // Get the argument's value.
const Expr *Arg = CE->getArg(0); const Expr *Arg = CE->getArg(0);
SVal ArgVal = state->getSVal(Arg, C.getLocationContext()); SVal ArgVal = C.getSVal(Arg);
Optional<DefinedSVal> DefArgVal = ArgVal.getAs<DefinedSVal>(); Optional<DefinedSVal> DefArgVal = ArgVal.getAs<DefinedSVal>();
if (!DefArgVal) if (!DefArgVal)
return; return;
@ -977,8 +976,7 @@ assumeCollectionNonEmpty(CheckerContext &C, ProgramStateRef State,
if (!State) if (!State)
return nullptr; return nullptr;
SymbolRef CollectionS = SymbolRef CollectionS = C.getSVal(FCS->getCollection()).getAsSymbol();
State->getSVal(FCS->getCollection(), C.getLocationContext()).getAsSymbol();
return assumeCollectionNonEmpty(C, State, CollectionS, Assumption); return assumeCollectionNonEmpty(C, State, CollectionS, Assumption);
} }
@ -1206,7 +1204,7 @@ ProgramStateRef
ObjCNonNilReturnValueChecker::assumeExprIsNonNull(const Expr *NonNullExpr, ObjCNonNilReturnValueChecker::assumeExprIsNonNull(const Expr *NonNullExpr,
ProgramStateRef State, ProgramStateRef State,
CheckerContext &C) const { CheckerContext &C) const {
SVal Val = State->getSVal(NonNullExpr, C.getLocationContext()); SVal Val = C.getSVal(NonNullExpr);
if (Optional<DefinedOrUnknownSVal> DV = Val.getAs<DefinedOrUnknownSVal>()) if (Optional<DefinedOrUnknownSVal> DV = Val.getAs<DefinedOrUnknownSVal>())
return State->assume(*DV, true); return State->assume(*DV, true);
return State; return State;

7
lib/StaticAnalyzer/Checkers/BuiltinFunctionChecker.cpp
View File

@ -43,7 +43,7 @@ bool BuiltinFunctionChecker::evalCall(const CallExpr *CE,
case Builtin::BI__builtin_assume: { case Builtin::BI__builtin_assume: {
assert (CE->arg_begin() != CE->arg_end()); assert (CE->arg_begin() != CE->arg_end());
SVal ArgSVal = state->getSVal(CE->getArg(0), LCtx); SVal ArgSVal = C.getSVal(CE->getArg(0));
if (ArgSVal.isUndef()) if (ArgSVal.isUndef())
return true; // Return true to model purity. return true; // Return true to model purity.
@ -68,7 +68,7 @@ bool BuiltinFunctionChecker::evalCall(const CallExpr *CE,
// __builtin_addressof is going from a reference to a pointer, but those // __builtin_addressof is going from a reference to a pointer, but those
// are represented the same way in the analyzer. // are represented the same way in the analyzer.
assert (CE->arg_begin() != CE->arg_end()); assert (CE->arg_begin() != CE->arg_end());
SVal X = state->getSVal(*(CE->arg_begin()), LCtx); SVal X = C.getSVal(*(CE->arg_begin()));
C.addTransition(state->BindExpr(CE, LCtx, X)); C.addTransition(state->BindExpr(CE, LCtx, X));
return true; return true;
} }
@ -83,8 +83,7 @@ bool BuiltinFunctionChecker::evalCall(const CallExpr *CE,
// Set the extent of the region in bytes. This enables us to use the // Set the extent of the region in bytes. This enables us to use the
// SVal of the argument directly. If we save the extent in bits, we // SVal of the argument directly. If we save the extent in bits, we
// cannot represent values like symbol*8. // cannot represent values like symbol*8.
DefinedOrUnknownSVal Size = auto Size = C.getSVal(*(CE->arg_begin())).castAs<DefinedOrUnknownSVal>();
state->getSVal(*(CE->arg_begin()), LCtx).castAs<DefinedOrUnknownSVal>();
SValBuilder& svalBuilder = C.getSValBuilder(); SValBuilder& svalBuilder = C.getSValBuilder();
DefinedOrUnknownSVal Extent = R->getExtent(svalBuilder); DefinedOrUnknownSVal Extent = R->getExtent(svalBuilder);

6
lib/StaticAnalyzer/Checkers/CStringChecker.cpp
View File

@ -366,7 +366,7 @@ ProgramStateRef CStringChecker::CheckBufferAccess(CheckerContext &C,
QualType PtrTy = Ctx.getPointerType(Ctx.CharTy); QualType PtrTy = Ctx.getPointerType(Ctx.CharTy);
// Check that the first buffer is non-null. // Check that the first buffer is non-null.
SVal BufVal = state->getSVal(FirstBuf, LCtx); SVal BufVal = C.getSVal(FirstBuf);
state = checkNonNull(C, state, FirstBuf, BufVal); state = checkNonNull(C, state, FirstBuf, BufVal);
if (!state) if (!state)
return nullptr; return nullptr;
@ -378,7 +378,7 @@ ProgramStateRef CStringChecker::CheckBufferAccess(CheckerContext &C,
// Get the access length and make sure it is known. // Get the access length and make sure it is known.
// FIXME: This assumes the caller has already checked that the access length // FIXME: This assumes the caller has already checked that the access length
// is positive. And that it's unsigned. // is positive. And that it's unsigned.
SVal LengthVal = state->getSVal(Size, LCtx); SVal LengthVal = C.getSVal(Size);
Optional<NonLoc> Length = LengthVal.getAs<NonLoc>(); Optional<NonLoc> Length = LengthVal.getAs<NonLoc>();
if (!Length) if (!Length)
return state; return state;
@ -2149,7 +2149,7 @@ void CStringChecker::checkPreStmt(const DeclStmt *DS, CheckerContext &C) const {
if (!MR) if (!MR)
continue; continue;
SVal StrVal = state->getSVal(Init, C.getLocationContext()); SVal StrVal = C.getSVal(Init);
assert(StrVal.isValid() && "Initializer string is unknown or undefined"); assert(StrVal.isValid() && "Initializer string is unknown or undefined");
DefinedOrUnknownSVal strLength = DefinedOrUnknownSVal strLength =
getCStringLength(C, state, Init, StrVal).castAs<DefinedOrUnknownSVal>(); getCStringLength(C, state, Init, StrVal).castAs<DefinedOrUnknownSVal>();

2
lib/StaticAnalyzer/Checkers/CastSizeChecker.cpp
View File

@ -101,7 +101,7 @@ void CastSizeChecker::checkPreStmt(const CastExpr *CE,CheckerContext &C) const {
return; return;
ProgramStateRef state = C.getState(); ProgramStateRef state = C.getState();
const MemRegion *R = state->getSVal(E, C.getLocationContext()).getAsRegion(); const MemRegion *R = C.getSVal(E).getAsRegion();
if (!R) if (!R)
return; return;

2
lib/StaticAnalyzer/Checkers/ChrootChecker.cpp
View File

@ -105,7 +105,7 @@ void ChrootChecker::Chdir(CheckerContext &C, const CallExpr *CE) const {
// After chdir("/"), enter the jail, set the enum value JAIL_ENTERED. // After chdir("/"), enter the jail, set the enum value JAIL_ENTERED.
const Expr *ArgExpr = CE->getArg(0); const Expr *ArgExpr = CE->getArg(0);
SVal ArgVal = state->getSVal(ArgExpr, C.getLocationContext()); SVal ArgVal = C.getSVal(ArgExpr);
if (const MemRegion *R = ArgVal.getAsRegion()) { if (const MemRegion *R = ArgVal.getAsRegion()) {
R = R->StripCasts(); R = R->StripCasts();

4
lib/StaticAnalyzer/Checkers/DeleteWithNonVirtualDtorChecker.cpp
View File

@ -110,8 +110,6 @@ DeleteWithNonVirtualDtorChecker::DeleteBugVisitor::VisitNode(
if (Satisfied) if (Satisfied)
return nullptr; return nullptr;
ProgramStateRef State = N->getState();
const LocationContext *LC = N->getLocationContext();
const Stmt *S = PathDiagnosticLocation::getStmt(N); const Stmt *S = PathDiagnosticLocation::getStmt(N);
if (!S) if (!S)
return nullptr; return nullptr;
@ -128,7 +126,7 @@ DeleteWithNonVirtualDtorChecker::DeleteBugVisitor::VisitNode(
} }
// Region associated with the current cast expression. // Region associated with the current cast expression.
const MemRegion *M = State->getSVal(CastE, LC).getAsRegion(); const MemRegion *M = N->getSVal(CastE).getAsRegion();
if (!M) if (!M)
return nullptr; return nullptr;

2
lib/StaticAnalyzer/Checkers/DivZeroChecker.cpp
View File

@ -57,7 +57,7 @@ void DivZeroChecker::checkPreStmt(const BinaryOperator *B,
if (!B->getRHS()->getType()->isScalarType()) if (!B->getRHS()->getType()->isScalarType())
return; return;
SVal Denom = C.getState()->getSVal(B->getRHS(), C.getLocationContext()); SVal Denom = C.getSVal(B->getRHS());
Optional<DefinedSVal> DV = Denom.getAs<DefinedSVal>(); Optional<DefinedSVal> DV = Denom.getAs<DefinedSVal>();
// Divide-by-undefined handled in the generic checking for uses of // Divide-by-undefined handled in the generic checking for uses of

2
lib/StaticAnalyzer/Checkers/DynamicTypePropagation.cpp
View File

@ -562,7 +562,7 @@ void DynamicTypePropagation::checkPostStmt(const CastExpr *CE,
DestObjectPtrType->isUnspecialized()) DestObjectPtrType->isUnspecialized())
return; return;
SymbolRef Sym = State->getSVal(CE, C.getLocationContext()).getAsSymbol(); SymbolRef Sym = C.getSVal(CE).getAsSymbol();
if (!Sym) if (!Sym)
return; return;

3
lib/StaticAnalyzer/Checkers/FixedAddressChecker.cpp
View File

@ -44,8 +44,7 @@ void FixedAddressChecker::checkPreStmt(const BinaryOperator *B,
if (!T->isPointerType()) if (!T->isPointerType())
return; return;
ProgramStateRef state = C.getState(); SVal RV = C.getSVal(B->getRHS());
SVal RV = state->getSVal(B->getRHS(), C.getLocationContext());
if (!RV.isConstant() || RV.isZeroConstant()) if (!RV.isConstant() || RV.isZeroConstant())
return; return;

4
lib/StaticAnalyzer/Checkers/GenericTaintChecker.cpp
View File

@ -468,7 +468,7 @@ bool GenericTaintChecker::checkPre(const CallExpr *CE, CheckerContext &C) const{
Optional<SVal> GenericTaintChecker::getPointedToSVal(CheckerContext &C, Optional<SVal> GenericTaintChecker::getPointedToSVal(CheckerContext &C,
const Expr *Arg) { const Expr *Arg) {
ProgramStateRef State = C.getState(); ProgramStateRef State = C.getState();
SVal AddrVal = State->getSVal(Arg->IgnoreParens(), C.getLocationContext()); SVal AddrVal = C.getSVal(Arg->IgnoreParens());
if (AddrVal.isUnknownOrUndef()) if (AddrVal.isUnknownOrUndef())
return None; return None;
@ -621,7 +621,7 @@ ProgramStateRef GenericTaintChecker::postRetTaint(const CallExpr *CE,
bool GenericTaintChecker::isStdin(const Expr *E, CheckerContext &C) { bool GenericTaintChecker::isStdin(const Expr *E, CheckerContext &C) {
ProgramStateRef State = C.getState(); ProgramStateRef State = C.getState();
SVal Val = State->getSVal(E, C.getLocationContext()); SVal Val = C.getSVal(E);
// stdin is a pointer, so it would be a region. // stdin is a pointer, so it would be a region.
const MemRegion *MemReg = Val.getAsRegion(); const MemRegion *MemReg = Val.getAsRegion();

5
lib/StaticAnalyzer/Checkers/IteratorChecker.cpp
View File

@ -355,12 +355,11 @@ void IteratorChecker::checkPostStmt(const MaterializeTemporaryExpr *MTE,
CheckerContext &C) const { CheckerContext &C) const {
/* Transfer iterator state to temporary objects */ /* Transfer iterator state to temporary objects */
auto State = C.getState(); auto State = C.getState();
const auto *LCtx = C.getLocationContext();
const auto *Pos = const auto *Pos =
getIteratorPosition(State, State->getSVal(MTE->GetTemporaryExpr(), LCtx)); getIteratorPosition(State, C.getSVal(MTE->GetTemporaryExpr()));
if (!Pos) if (!Pos)
return; return;
State = setIteratorPosition(State, State->getSVal(MTE, LCtx), *Pos); State = setIteratorPosition(State, C.getSVal(MTE), *Pos);
C.addTransition(State); C.addTransition(State);
} }

3
lib/StaticAnalyzer/Checkers/LocalizationChecker.cpp
View File

@ -1017,8 +1017,7 @@ NonLocalizedStringBRVisitor::VisitNode(const ExplodedNode *Succ,
if (!LiteralExpr) if (!LiteralExpr)
return nullptr; return nullptr;
ProgramStateRef State = Succ->getState(); SVal LiteralSVal = Succ->getSVal(LiteralExpr);
SVal LiteralSVal = State->getSVal(LiteralExpr, Succ->getLocationContext());
if (LiteralSVal.getAsRegion() != NonLocalizedString) if (LiteralSVal.getAsRegion() != NonLocalizedString)
return nullptr; return nullptr;

7
lib/StaticAnalyzer/Checkers/MacOSKeychainAPIChecker.cpp
View File

@ -202,7 +202,7 @@ static bool isBadDeallocationArgument(const MemRegion *Arg) {
static SymbolRef getAsPointeeSymbol(const Expr *Expr, static SymbolRef getAsPointeeSymbol(const Expr *Expr,
CheckerContext &C) { CheckerContext &C) {
ProgramStateRef State = C.getState(); ProgramStateRef State = C.getState();
SVal ArgV = State->getSVal(Expr, C.getLocationContext()); SVal ArgV = C.getSVal(Expr);
if (Optional<loc::MemRegionVal> X = ArgV.getAs<loc::MemRegionVal>()) { if (Optional<loc::MemRegionVal> X = ArgV.getAs<loc::MemRegionVal>()) {
StoreManager& SM = C.getStoreManager(); StoreManager& SM = C.getStoreManager();
@ -297,7 +297,7 @@ void MacOSKeychainAPIChecker::checkPreStmt(const CallExpr *CE,
// Check the argument to the deallocator. // Check the argument to the deallocator.
const Expr *ArgExpr = CE->getArg(paramIdx); const Expr *ArgExpr = CE->getArg(paramIdx);
SVal ArgSVal = State->getSVal(ArgExpr, C.getLocationContext()); SVal ArgSVal = C.getSVal(ArgExpr);
// Undef is reported by another checker. // Undef is reported by another checker.
if (ArgSVal.isUndef()) if (ArgSVal.isUndef())
@ -426,8 +426,7 @@ void MacOSKeychainAPIChecker::checkPostStmt(const CallExpr *CE,
// allocated value symbol, since our diagnostics depend on the value // allocated value symbol, since our diagnostics depend on the value
// returned by the call. Ex: Data should only be freed if noErr was // returned by the call. Ex: Data should only be freed if noErr was
// returned during allocation.) // returned during allocation.)
SymbolRef RetStatusSymbol = SymbolRef RetStatusSymbol = C.getSVal(CE).getAsSymbol();
State->getSVal(CE, C.getLocationContext()).getAsSymbol();
C.getSymbolManager().addSymbolDependency(V, RetStatusSymbol); C.getSymbolManager().addSymbolDependency(V, RetStatusSymbol);
// Track the allocated value in the checker state. // Track the allocated value in the checker state.

28
lib/StaticAnalyzer/Checkers/MallocChecker.cpp
View File

@ -758,7 +758,7 @@ llvm::Optional<ProgramStateRef> MallocChecker::performKernelMalloc(
return None; return None;
const Expr *FlagsEx = CE->getArg(CE->getNumArgs() - 1); const Expr *FlagsEx = CE->getArg(CE->getNumArgs() - 1);
const SVal V = State->getSVal(FlagsEx, C.getLocationContext()); const SVal V = C.getSVal(FlagsEx);
if (!V.getAs<NonLoc>()) { if (!V.getAs<NonLoc>()) {
// The case where 'V' can be a location can only be due to a bad header, // The case where 'V' can be a location can only be due to a bad header,
// so in this case bail out. // so in this case bail out.
@ -972,8 +972,7 @@ ProgramStateRef MallocChecker::ProcessZeroAllocation(CheckerContext &C,
assert(Arg); assert(Arg);
Optional<DefinedSVal> DefArgVal = Optional<DefinedSVal> DefArgVal = C.getSVal(Arg).getAs<DefinedSVal>();
State->getSVal(Arg, C.getLocationContext()).getAs<DefinedSVal>();
if (!DefArgVal) if (!DefArgVal)
return State; return State;
@ -988,7 +987,7 @@ ProgramStateRef MallocChecker::ProcessZeroAllocation(CheckerContext &C,
State->assume(SvalBuilder.evalEQ(State, *DefArgVal, Zero)); State->assume(SvalBuilder.evalEQ(State, *DefArgVal, Zero));
if (TrueState && !FalseState) { if (TrueState && !FalseState) {
SVal retVal = State->getSVal(E, C.getLocationContext()); SVal retVal = C.getSVal(E);
SymbolRef Sym = retVal.getAsLocSymbol(); SymbolRef Sym = retVal.getAsLocSymbol();
if (!Sym) if (!Sym)
return State; return State;
@ -1092,7 +1091,7 @@ ProgramStateRef MallocChecker::addExtentSize(CheckerContext &C,
const SubRegion *Region; const SubRegion *Region;
if (NE->isArray()) { if (NE->isArray()) {
const Expr *SizeExpr = NE->getArraySize(); const Expr *SizeExpr = NE->getArraySize();
ElementCount = State->getSVal(SizeExpr, C.getLocationContext()); ElementCount = C.getSVal(SizeExpr);
// Store the extent size for the (symbolic)region // Store the extent size for the (symbolic)region
// containing the elements. // containing the elements.
Region = (State->getSVal(NE, LCtx)) Region = (State->getSVal(NE, LCtx))
@ -1212,8 +1211,7 @@ ProgramStateRef MallocChecker::MallocMemAux(CheckerContext &C,
if (!State) if (!State)
return nullptr; return nullptr;
return MallocMemAux(C, CE, State->getSVal(SizeEx, C.getLocationContext()), return MallocMemAux(C, CE, C.getSVal(SizeEx), Init, State, Family);
Init, State, Family);
} }
ProgramStateRef MallocChecker::MallocMemAux(CheckerContext &C, ProgramStateRef MallocChecker::MallocMemAux(CheckerContext &C,
@ -1268,7 +1266,7 @@ ProgramStateRef MallocChecker::MallocUpdateRefState(CheckerContext &C,
return nullptr; return nullptr;
// Get the return value. // Get the return value.
SVal retVal = State->getSVal(E, C.getLocationContext()); SVal retVal = C.getSVal(E);
// We expect the malloc functions to return a pointer. // We expect the malloc functions to return a pointer.
if (!retVal.getAs<Loc>()) if (!retVal.getAs<Loc>())
@ -1457,7 +1455,7 @@ ProgramStateRef MallocChecker::FreeMemAux(CheckerContext &C,
if (!State) if (!State)
return nullptr; return nullptr;
SVal ArgVal = State->getSVal(ArgExpr, C.getLocationContext()); SVal ArgVal = C.getSVal(ArgExpr);
if (!ArgVal.getAs<DefinedOrUnknownSVal>()) if (!ArgVal.getAs<DefinedOrUnknownSVal>())
return nullptr; return nullptr;
DefinedOrUnknownSVal location = ArgVal.castAs<DefinedOrUnknownSVal>(); DefinedOrUnknownSVal location = ArgVal.castAs<DefinedOrUnknownSVal>();
@ -2084,8 +2082,7 @@ ProgramStateRef MallocChecker::ReallocMemAux(CheckerContext &C,
return nullptr; return nullptr;
const Expr *arg0Expr = CE->getArg(0); const Expr *arg0Expr = CE->getArg(0);
const LocationContext *LCtx = C.getLocationContext(); SVal Arg0Val = C.getSVal(arg0Expr);
SVal Arg0Val = State->getSVal(arg0Expr, LCtx);
if (!Arg0Val.getAs<DefinedOrUnknownSVal>()) if (!Arg0Val.getAs<DefinedOrUnknownSVal>())
return nullptr; return nullptr;
DefinedOrUnknownSVal arg0Val = Arg0Val.castAs<DefinedOrUnknownSVal>(); DefinedOrUnknownSVal arg0Val = Arg0Val.castAs<DefinedOrUnknownSVal>();
@ -2099,7 +2096,7 @@ ProgramStateRef MallocChecker::ReallocMemAux(CheckerContext &C,
const Expr *Arg1 = CE->getArg(1); const Expr *Arg1 = CE->getArg(1);
// Get the value of the size argument. // Get the value of the size argument.
SVal TotalSize = State->getSVal(Arg1, LCtx); SVal TotalSize = C.getSVal(Arg1);
if (SuffixWithN) if (SuffixWithN)
TotalSize = evalMulForBufferSize(C, Arg1, CE->getArg(2)); TotalSize = evalMulForBufferSize(C, Arg1, CE->getArg(2));
if (!TotalSize.getAs<DefinedOrUnknownSVal>()) if (!TotalSize.getAs<DefinedOrUnknownSVal>())
@ -2133,7 +2130,7 @@ ProgramStateRef MallocChecker::ReallocMemAux(CheckerContext &C,
// Get the from and to pointer symbols as in toPtr = realloc(fromPtr, size). // Get the from and to pointer symbols as in toPtr = realloc(fromPtr, size).
assert(!PrtIsNull); assert(!PrtIsNull);
SymbolRef FromPtr = arg0Val.getAsSymbol(); SymbolRef FromPtr = arg0Val.getAsSymbol();
SVal RetVal = State->getSVal(CE, LCtx); SVal RetVal = C.getSVal(CE);
SymbolRef ToPtr = RetVal.getAsSymbol(); SymbolRef ToPtr = RetVal.getAsSymbol();
if (!FromPtr || !ToPtr) if (!FromPtr || !ToPtr)
return nullptr; return nullptr;
@ -2406,7 +2403,7 @@ void MallocChecker::checkPreStmt(const ReturnStmt *S, CheckerContext &C) const {
// Check if we are returning a symbol. // Check if we are returning a symbol.
ProgramStateRef State = C.getState(); ProgramStateRef State = C.getState();
SVal RetVal = State->getSVal(E, C.getLocationContext()); SVal RetVal = C.getSVal(E);
SymbolRef Sym = RetVal.getAsSymbol(); SymbolRef Sym = RetVal.getAsSymbol();
if (!Sym) if (!Sym)
// If we are returning a field of the allocated struct or an array element, // If we are returning a field of the allocated struct or an array element,
@ -2436,8 +2433,7 @@ void MallocChecker::checkPostStmt(const BlockExpr *BE,
ProgramStateRef state = C.getState(); ProgramStateRef state = C.getState();
const BlockDataRegion *R = const BlockDataRegion *R =
cast<BlockDataRegion>(state->getSVal(BE, cast<BlockDataRegion>(C.getSVal(BE).getAsRegion());
C.getLocationContext()).getAsRegion());
BlockDataRegion::referenced_vars_iterator I = R->referenced_vars_begin(), BlockDataRegion::referenced_vars_iterator I = R->referenced_vars_begin(),
E = R->referenced_vars_end(); E = R->referenced_vars_end();

6
lib/StaticAnalyzer/Checkers/NullabilityChecker.cpp
View File

@ -560,8 +560,7 @@ void NullabilityChecker::checkPreStmt(const ReturnStmt *S,
if (State->get<InvariantViolated>()) if (State->get<InvariantViolated>())
return; return;
auto RetSVal = auto RetSVal = C.getSVal(S).getAs<DefinedOrUnknownSVal>();
State->getSVal(S, C.getLocationContext()).getAs<DefinedOrUnknownSVal>();
if (!RetSVal) if (!RetSVal)
return; return;
@ -977,8 +976,7 @@ void NullabilityChecker::checkPostStmt(const ExplicitCastExpr *CE,
if (DestNullability == Nullability::Unspecified) if (DestNullability == Nullability::Unspecified)
return; return;
auto RegionSVal = auto RegionSVal = C.getSVal(CE).getAs<DefinedOrUnknownSVal>();
State->getSVal(CE, C.getLocationContext()).getAs<DefinedOrUnknownSVal>();
const MemRegion *Region = getTrackRegion(*RegionSVal); const MemRegion *Region = getTrackRegion(*RegionSVal);
if (!Region) if (!Region)
return; return;

2
lib/StaticAnalyzer/Checkers/ObjCAtSyncChecker.cpp
View File

@ -39,7 +39,7 @@ void ObjCAtSyncChecker::checkPreStmt(const ObjCAtSynchronizedStmt *S,
const Expr *Ex = S->getSynchExpr(); const Expr *Ex = S->getSynchExpr();
ProgramStateRef state = C.getState(); ProgramStateRef state = C.getState();
SVal V = state->getSVal(Ex, C.getLocationContext()); SVal V = C.getSVal(Ex);
// Uninitialized value used for the mutex? // Uninitialized value used for the mutex?
if (V.getAs<UndefinedVal>()) { if (V.getAs<UndefinedVal>()) {

8
lib/StaticAnalyzer/Checkers/ObjCContainersChecker.cpp
View File

@ -39,7 +39,7 @@ class ObjCContainersChecker : public Checker< check::PreStmt<CallExpr>,
} }
inline SymbolRef getArraySym(const Expr *E, CheckerContext &C) const { inline SymbolRef getArraySym(const Expr *E, CheckerContext &C) const {
SVal ArrayRef = C.getState()->getSVal(E, C.getLocationContext()); SVal ArrayRef = C.getSVal(E);
SymbolRef ArraySym = ArrayRef.getAsSymbol(); SymbolRef ArraySym = ArrayRef.getAsSymbol();
return ArraySym; return ArraySym;
} }
@ -66,13 +66,13 @@ REGISTER_MAP_WITH_PROGRAMSTATE(ArraySizeMap, SymbolRef, DefinedSVal)
void ObjCContainersChecker::addSizeInfo(const Expr *Array, const Expr *Size, void ObjCContainersChecker::addSizeInfo(const Expr *Array, const Expr *Size,
CheckerContext &C) const { CheckerContext &C) const {
ProgramStateRef State = C.getState(); ProgramStateRef State = C.getState();
SVal SizeV = State->getSVal(Size, C.getLocationContext()); SVal SizeV = C.getSVal(Size);
// Undefined is reported by another checker. // Undefined is reported by another checker.
if (SizeV.isUnknownOrUndef()) if (SizeV.isUnknownOrUndef())
return; return;
// Get the ArrayRef symbol. // Get the ArrayRef symbol.
SVal ArrayRef = State->getSVal(Array, C.getLocationContext()); SVal ArrayRef = C.getSVal(Array);
SymbolRef ArraySym = ArrayRef.getAsSymbol(); SymbolRef ArraySym = ArrayRef.getAsSymbol();
if (!ArraySym) if (!ArraySym)
return; return;
@ -128,7 +128,7 @@ void ObjCContainersChecker::checkPreStmt(const CallExpr *CE,
// Get the index. // Get the index.
const Expr *IdxExpr = CE->getArg(1); const Expr *IdxExpr = CE->getArg(1);
SVal IdxVal = State->getSVal(IdxExpr, C.getLocationContext()); SVal IdxVal = C.getSVal(IdxExpr);
if (IdxVal.isUnknownOrUndef()) if (IdxVal.isUnknownOrUndef())
return; return;
DefinedSVal Idx = IdxVal.castAs<DefinedSVal>(); DefinedSVal Idx = IdxVal.castAs<DefinedSVal>();

4
lib/StaticAnalyzer/Checkers/ObjCSelfInitChecker.cpp
View File

@ -132,7 +132,7 @@ static bool hasSelfFlag(SVal val, SelfFlagEnum flag, CheckerContext &C) {
/// points to and is an object that did not come from the result of calling /// points to and is an object that did not come from the result of calling
/// an initializer. /// an initializer.
static bool isInvalidSelf(const Expr *E, CheckerContext &C) { static bool isInvalidSelf(const Expr *E, CheckerContext &C) {
SVal exprVal = C.getState()->getSVal(E, C.getLocationContext()); SVal exprVal = C.getSVal(E);
if (!hasSelfFlag(exprVal, SelfFlag_Self, C)) if (!hasSelfFlag(exprVal, SelfFlag_Self, C))
return false; // value did not come from 'self'. return false; // value did not come from 'self'.
if (hasSelfFlag(exprVal, SelfFlag_InitRes, C)) if (hasSelfFlag(exprVal, SelfFlag_InitRes, C))
@ -183,7 +183,7 @@ void ObjCSelfInitChecker::checkPostObjCMessage(const ObjCMethodCall &Msg,
// value out when we return from this method. // value out when we return from this method.
state = state->set<CalledInit>(true); state = state->set<CalledInit>(true);
SVal V = state->getSVal(Msg.getOriginExpr(), C.getLocationContext()); SVal V = C.getSVal(Msg.getOriginExpr());
addSelfFlag(state, V, SelfFlag_InitRes, C); addSelfFlag(state, V, SelfFlag_InitRes, C);
return; return;
} }

18
lib/StaticAnalyzer/Checkers/PointerArithChecker.cpp
View File

@ -154,8 +154,7 @@ void PointerArithChecker::reportPointerArithMisuse(const Expr *E,
return; return;
ProgramStateRef State = C.getState(); ProgramStateRef State = C.getState();
const MemRegion *Region = const MemRegion *Region = C.getSVal(E).getAsRegion();
State->getSVal(E, C.getLocationContext()).getAsRegion();
if (!Region) if (!Region)
return; return;
if (PointedNeeded) if (PointedNeeded)
@ -227,7 +226,7 @@ void PointerArithChecker::checkPostStmt(const CallExpr *CE,
if (AllocFunctions.count(FunI) == 0) if (AllocFunctions.count(FunI) == 0)
return; return;
SVal SV = State->getSVal(CE, C.getLocationContext()); SVal SV = C.getSVal(CE);
const MemRegion *Region = SV.getAsRegion(); const MemRegion *Region = SV.getAsRegion();
if (!Region) if (!Region)
return; return;
@ -248,7 +247,7 @@ void PointerArithChecker::checkPostStmt(const CXXNewExpr *NE,
AllocKind Kind = getKindOfNewOp(NE, FD); AllocKind Kind = getKindOfNewOp(NE, FD);
ProgramStateRef State = C.getState(); ProgramStateRef State = C.getState();
SVal AllocedVal = State->getSVal(NE, C.getLocationContext()); SVal AllocedVal = C.getSVal(NE);
const MemRegion *Region = AllocedVal.getAsRegion(); const MemRegion *Region = AllocedVal.getAsRegion();
if (!Region) if (!Region)
return; return;
@ -263,7 +262,7 @@ void PointerArithChecker::checkPostStmt(const CastExpr *CE,
const Expr *CastedExpr = CE->getSubExpr(); const Expr *CastedExpr = CE->getSubExpr();
ProgramStateRef State = C.getState(); ProgramStateRef State = C.getState();
SVal CastedVal = State->getSVal(CastedExpr, C.getLocationContext()); SVal CastedVal = C.getSVal(CastedExpr);
const MemRegion *Region = CastedVal.getAsRegion(); const MemRegion *Region = CastedVal.getAsRegion();
if (!Region) if (!Region)
@ -281,7 +280,7 @@ void PointerArithChecker::checkPreStmt(const CastExpr *CE,
const Expr *CastedExpr = CE->getSubExpr(); const Expr *CastedExpr = CE->getSubExpr();
ProgramStateRef State = C.getState(); ProgramStateRef State = C.getState();
SVal CastedVal = State->getSVal(CastedExpr, C.getLocationContext()); SVal CastedVal = C.getSVal(CastedExpr);
const MemRegion *Region = CastedVal.getAsRegion(); const MemRegion *Region = CastedVal.getAsRegion();
if (!Region) if (!Region)
@ -304,8 +303,7 @@ void PointerArithChecker::checkPreStmt(const UnaryOperator *UOp,
void PointerArithChecker::checkPreStmt(const ArraySubscriptExpr *SubsExpr, void PointerArithChecker::checkPreStmt(const ArraySubscriptExpr *SubsExpr,
CheckerContext &C) const { CheckerContext &C) const {
ProgramStateRef State = C.getState(); SVal Idx = C.getSVal(SubsExpr->getIdx());
SVal Idx = State->getSVal(SubsExpr->getIdx(), C.getLocationContext());
// Indexing with 0 is OK. // Indexing with 0 is OK.
if (Idx.isZeroConstant()) if (Idx.isZeroConstant())
@ -324,14 +322,14 @@ void PointerArithChecker::checkPreStmt(const BinaryOperator *BOp,
ProgramStateRef State = C.getState(); ProgramStateRef State = C.getState();
if (Rhs->getType()->isIntegerType() && Lhs->getType()->isPointerType()) { if (Rhs->getType()->isIntegerType() && Lhs->getType()->isPointerType()) {
SVal RHSVal = State->getSVal(Rhs, C.getLocationContext()); SVal RHSVal = C.getSVal(Rhs);
if (State->isNull(RHSVal).isConstrainedTrue()) if (State->isNull(RHSVal).isConstrainedTrue())
return; return;
reportPointerArithMisuse(Lhs, C, !BOp->isAdditiveOp()); reportPointerArithMisuse(Lhs, C, !BOp->isAdditiveOp());
} }
// The int += ptr; case is not valid C++. // The int += ptr; case is not valid C++.
if (Lhs->getType()->isIntegerType() && Rhs->getType()->isPointerType()) { if (Lhs->getType()->isIntegerType() && Rhs->getType()->isPointerType()) {
SVal LHSVal = State->getSVal(Lhs, C.getLocationContext()); SVal LHSVal = C.getSVal(Lhs);
if (State->isNull(LHSVal).isConstrainedTrue()) if (State->isNull(LHSVal).isConstrainedTrue())
return; return;
reportPointerArithMisuse(Rhs, C); reportPointerArithMisuse(Rhs, C);

6
lib/StaticAnalyzer/Checkers/PointerSubChecker.cpp
View File

@ -39,10 +39,8 @@ void PointerSubChecker::checkPreStmt(const BinaryOperator *B,
if (B->getOpcode() != BO_Sub) if (B->getOpcode() != BO_Sub)
return; return;
ProgramStateRef state = C.getState(); SVal LV = C.getSVal(B->getLHS());
const LocationContext *LCtx = C.getLocationContext(); SVal RV = C.getSVal(B->getRHS());
SVal LV = state->getSVal(B->getLHS(), LCtx);
SVal RV = state->getSVal(B->getRHS(), LCtx);
const MemRegion *LR = LV.getAsRegion(); const MemRegion *LR = LV.getAsRegion();
const MemRegion *RR = RV.getAsRegion(); const MemRegion *RR = RV.getAsRegion();

23
lib/StaticAnalyzer/Checkers/PthreadLockChecker.cpp
View File

@ -109,8 +109,6 @@ REGISTER_MAP_WITH_PROGRAMSTATE(DestroyRetVal, const MemRegion *, SymbolRef)
void PthreadLockChecker::checkPostStmt(const CallExpr *CE, void PthreadLockChecker::checkPostStmt(const CallExpr *CE,
CheckerContext &C) const { CheckerContext &C) const {
ProgramStateRef state = C.getState();
const LocationContext *LCtx = C.getLocationContext();
StringRef FName = C.getCalleeName(CE); StringRef FName = C.getCalleeName(CE);
if (FName.empty()) if (FName.empty())
return; return;
@ -121,34 +119,31 @@ void PthreadLockChecker::checkPostStmt(const CallExpr *CE,
if (FName == "pthread_mutex_lock" || if (FName == "pthread_mutex_lock" ||
FName == "pthread_rwlock_rdlock" || FName == "pthread_rwlock_rdlock" ||
FName == "pthread_rwlock_wrlock") FName == "pthread_rwlock_wrlock")
AcquireLock(C, CE, state->getSVal(CE->getArg(0), LCtx), AcquireLock(C, CE, C.getSVal(CE->getArg(0)), false, PthreadSemantics);
false, PthreadSemantics);
else if (FName == "lck_mtx_lock" || else if (FName == "lck_mtx_lock" ||
FName == "lck_rw_lock_exclusive" || FName == "lck_rw_lock_exclusive" ||
FName == "lck_rw_lock_shared") FName == "lck_rw_lock_shared")
AcquireLock(C, CE, state->getSVal(CE->getArg(0), LCtx), AcquireLock(C, CE, C.getSVal(CE->getArg(0)), false, XNUSemantics);
false, XNUSemantics);
else if (FName == "pthread_mutex_trylock" || else if (FName == "pthread_mutex_trylock" ||
FName == "pthread_rwlock_tryrdlock" || FName == "pthread_rwlock_tryrdlock" ||
FName == "pthread_rwlock_trywrlock") FName == "pthread_rwlock_trywrlock")
AcquireLock(C, CE, state->getSVal(CE->getArg(0), LCtx), AcquireLock(C, CE, C.getSVal(CE->getArg(0)),
true, PthreadSemantics); true, PthreadSemantics);
else if (FName == "lck_mtx_try_lock" || else if (FName == "lck_mtx_try_lock" ||
FName == "lck_rw_try_lock_exclusive" || FName == "lck_rw_try_lock_exclusive" ||
FName == "lck_rw_try_lock_shared") FName == "lck_rw_try_lock_shared")
AcquireLock(C, CE, state->getSVal(CE->getArg(0), LCtx), AcquireLock(C, CE, C.getSVal(CE->getArg(0)), true, XNUSemantics);
true, XNUSemantics);
else if (FName == "pthread_mutex_unlock" || else if (FName == "pthread_mutex_unlock" ||
FName == "pthread_rwlock_unlock" || FName == "pthread_rwlock_unlock" ||
FName == "lck_mtx_unlock" || FName == "lck_mtx_unlock" ||
FName == "lck_rw_done") FName == "lck_rw_done")
ReleaseLock(C, CE, state->getSVal(CE->getArg(0), LCtx)); ReleaseLock(C, CE, C.getSVal(CE->getArg(0)));
else if (FName == "pthread_mutex_destroy") else if (FName == "pthread_mutex_destroy")
DestroyLock(C, CE, state->getSVal(CE->getArg(0), LCtx), PthreadSemantics); DestroyLock(C, CE, C.getSVal(CE->getArg(0)), PthreadSemantics);
else if (FName == "lck_mtx_destroy") else if (FName == "lck_mtx_destroy")
DestroyLock(C, CE, state->getSVal(CE->getArg(0), LCtx), XNUSemantics); DestroyLock(C, CE, C.getSVal(CE->getArg(0)), XNUSemantics);
else if (FName == "pthread_mutex_init") else if (FName == "pthread_mutex_init")
InitLock(C, CE, state->getSVal(CE->getArg(0), LCtx)); InitLock(C, CE, C.getSVal(CE->getArg(0)));
} }
// When a lock is destroyed, in some semantics(like PthreadSemantics) we are not // When a lock is destroyed, in some semantics(like PthreadSemantics) we are not
@ -232,7 +227,7 @@ void PthreadLockChecker::AcquireLock(CheckerContext &C, const CallExpr *CE,
if (sym) if (sym)
state = resolvePossiblyDestroyedMutex(state, lockR, sym); state = resolvePossiblyDestroyedMutex(state, lockR, sym);
SVal X = state->getSVal(CE, C.getLocationContext()); SVal X = C.getSVal(CE);
if (X.isUnknownOrUndef()) if (X.isUnknownOrUndef())
return; return;

11
lib/StaticAnalyzer/Checkers/RetainCountChecker.cpp
View File

@ -2799,9 +2799,7 @@ void RetainCountChecker::checkPostStmt(const BlockExpr *BE,
return; return;
ProgramStateRef state = C.getState(); ProgramStateRef state = C.getState();
const BlockDataRegion *R = auto *R = cast<BlockDataRegion>(C.getSVal(BE).getAsRegion());
cast<BlockDataRegion>(state->getSVal(BE,
C.getLocationContext()).getAsRegion());
BlockDataRegion::referenced_vars_iterator I = R->referenced_vars_begin(), BlockDataRegion::referenced_vars_iterator I = R->referenced_vars_begin(),
E = R->referenced_vars_end(); E = R->referenced_vars_end();
@ -2851,7 +2849,7 @@ void RetainCountChecker::checkPostStmt(const CastExpr *CE,
} }
ProgramStateRef state = C.getState(); ProgramStateRef state = C.getState();
SymbolRef Sym = state->getSVal(CE, C.getLocationContext()).getAsLocSymbol(); SymbolRef Sym = C.getSVal(CE).getAsLocSymbol();
if (!Sym) if (!Sym)
return; return;
const RefVal* T = getRefBinding(state, Sym); const RefVal* T = getRefBinding(state, Sym);
@ -2874,7 +2872,7 @@ void RetainCountChecker::processObjCLiterals(CheckerContext &C,
ProgramStateRef state = C.getState(); ProgramStateRef state = C.getState();
const ExplodedNode *pred = C.getPredecessor(); const ExplodedNode *pred = C.getPredecessor();
for (const Stmt *Child : Ex->children()) { for (const Stmt *Child : Ex->children()) {
SVal V = state->getSVal(Child, pred->getLocationContext()); SVal V = pred->getSVal(Child);
if (SymbolRef sym = V.getAsSymbol()) if (SymbolRef sym = V.getAsSymbol())
if (const RefVal* T = getRefBinding(state, sym)) { if (const RefVal* T = getRefBinding(state, sym)) {
RefVal::Kind hasErr = (RefVal::Kind) 0; RefVal::Kind hasErr = (RefVal::Kind) 0;
@ -2913,10 +2911,9 @@ void RetainCountChecker::checkPostStmt(const ObjCDictionaryLiteral *DL,
void RetainCountChecker::checkPostStmt(const ObjCBoxedExpr *Ex, void RetainCountChecker::checkPostStmt(const ObjCBoxedExpr *Ex,
CheckerContext &C) const { CheckerContext &C) const {
const ExplodedNode *Pred = C.getPredecessor(); const ExplodedNode *Pred = C.getPredecessor();
const LocationContext *LCtx = Pred->getLocationContext();
ProgramStateRef State = Pred->getState(); ProgramStateRef State = Pred->getState();
if (SymbolRef Sym = State->getSVal(Ex, LCtx).getAsSymbol()) { if (SymbolRef Sym = Pred->getSVal(Ex).getAsSymbol()) {
QualType ResultTy = Ex->getType(); QualType ResultTy = Ex->getType();
State = setRefBinding(State, Sym, State = setRefBinding(State, Sym,
RefVal::makeNotOwned(RetEffect::ObjC, ResultTy)); RefVal::makeNotOwned(RetEffect::ObjC, ResultTy));

2
lib/StaticAnalyzer/Checkers/ReturnPointerRangeChecker.cpp
View File

@ -40,7 +40,7 @@ void ReturnPointerRangeChecker::checkPreStmt(const ReturnStmt *RS,
if (!RetE) if (!RetE)
return; return;
SVal V = state->getSVal(RetE, C.getLocationContext()); SVal V = C.getSVal(RetE);
const MemRegion *R = V.getAsRegion(); const MemRegion *R = V.getAsRegion();
const ElementRegion *ER = dyn_cast_or_null<ElementRegion>(R); const ElementRegion *ER = dyn_cast_or_null<ElementRegion>(R);

3
lib/StaticAnalyzer/Checkers/StackAddrEscapeChecker.cpp
View File

@ -255,8 +255,7 @@ void StackAddrEscapeChecker::checkPreStmt(const ReturnStmt *RS,
return; return;
RetE = RetE->IgnoreParens(); RetE = RetE->IgnoreParens();
const LocationContext *LCtx = C.getLocationContext(); SVal V = C.getSVal(RetE);
SVal V = C.getState()->getSVal(RetE, LCtx);
const MemRegion *R = V.getAsRegion(); const MemRegion *R = V.getAsRegion();
if (!R) if (!R)
return; return;

36
lib/StaticAnalyzer/Checkers/StreamChecker.cpp
View File

@ -242,22 +242,19 @@ void StreamChecker::Fclose(CheckerContext &C, const CallExpr *CE) const {
void StreamChecker::Fread(CheckerContext &C, const CallExpr *CE) const { void StreamChecker::Fread(CheckerContext &C, const CallExpr *CE) const {
ProgramStateRef state = C.getState(); ProgramStateRef state = C.getState();
if (!CheckNullStream(state->getSVal(CE->getArg(3), C.getLocationContext()), if (!CheckNullStream(C.getSVal(CE->getArg(3)), state, C))
state, C))
return; return;
} }
void StreamChecker::Fwrite(CheckerContext &C, const CallExpr *CE) const { void StreamChecker::Fwrite(CheckerContext &C, const CallExpr *CE) const {
ProgramStateRef state = C.getState(); ProgramStateRef state = C.getState();
if (!CheckNullStream(state->getSVal(CE->getArg(3), C.getLocationContext()), if (!CheckNullStream(C.getSVal(CE->getArg(3)), state, C))
state, C))
return; return;
} }
void StreamChecker::Fseek(CheckerContext &C, const CallExpr *CE) const { void StreamChecker::Fseek(CheckerContext &C, const CallExpr *CE) const {
ProgramStateRef state = C.getState(); ProgramStateRef state = C.getState();
if (!(state = CheckNullStream(state->getSVal(CE->getArg(0), if (!(state = CheckNullStream(C.getSVal(CE->getArg(0)), state, C)))
C.getLocationContext()), state, C)))
return; return;
// Check the legality of the 'whence' argument of 'fseek'. // Check the legality of the 'whence' argument of 'fseek'.
SVal Whence = state->getSVal(CE->getArg(2), C.getLocationContext()); SVal Whence = state->getSVal(CE->getArg(2), C.getLocationContext());
@ -283,57 +280,49 @@ void StreamChecker::Fseek(CheckerContext &C, const CallExpr *CE) const {
void StreamChecker::Ftell(CheckerContext &C, const CallExpr *CE) const { void StreamChecker::Ftell(CheckerContext &C, const CallExpr *CE) const {
ProgramStateRef state = C.getState(); ProgramStateRef state = C.getState();
if (!CheckNullStream(state->getSVal(CE->getArg(0), C.getLocationContext()), if (!CheckNullStream(C.getSVal(CE->getArg(0)), state, C))
state, C))
return; return;
} }
void StreamChecker::Rewind(CheckerContext &C, const CallExpr *CE) const { void StreamChecker::Rewind(CheckerContext &C, const CallExpr *CE) const {
ProgramStateRef state = C.getState(); ProgramStateRef state = C.getState();
if (!CheckNullStream(state->getSVal(CE->getArg(0), C.getLocationContext()), if (!CheckNullStream(C.getSVal(CE->getArg(0)), state, C))
state, C))
return; return;
} }
void StreamChecker::Fgetpos(CheckerContext &C, const CallExpr *CE) const { void StreamChecker::Fgetpos(CheckerContext &C, const CallExpr *CE) const {
ProgramStateRef state = C.getState(); ProgramStateRef state = C.getState();
if (!CheckNullStream(state->getSVal(CE->getArg(0), C.getLocationContext()), if (!CheckNullStream(C.getSVal(CE->getArg(0)), state, C))
state, C))
return; return;
} }
void StreamChecker::Fsetpos(CheckerContext &C, const CallExpr *CE) const { void StreamChecker::Fsetpos(CheckerContext &C, const CallExpr *CE) const {
ProgramStateRef state = C.getState(); ProgramStateRef state = C.getState();
if (!CheckNullStream(state->getSVal(CE->getArg(0), C.getLocationContext()), if (!CheckNullStream(C.getSVal(CE->getArg(0)), state, C))
state, C))
return; return;
} }
void StreamChecker::Clearerr(CheckerContext &C, const CallExpr *CE) const { void StreamChecker::Clearerr(CheckerContext &C, const CallExpr *CE) const {
ProgramStateRef state = C.getState(); ProgramStateRef state = C.getState();
if (!CheckNullStream(state->getSVal(CE->getArg(0), C.getLocationContext()), if (!CheckNullStream(C.getSVal(CE->getArg(0)), state, C))
state, C))
return; return;
} }
void StreamChecker::Feof(CheckerContext &C, const CallExpr *CE) const { void StreamChecker::Feof(CheckerContext &C, const CallExpr *CE) const {
ProgramStateRef state = C.getState(); ProgramStateRef state = C.getState();
if (!CheckNullStream(state->getSVal(CE->getArg(0), C.getLocationContext()), if (!CheckNullStream(C.getSVal(CE->getArg(0)), state, C))
state, C))
return; return;
} }
void StreamChecker::Ferror(CheckerContext &C, const CallExpr *CE) const { void StreamChecker::Ferror(CheckerContext &C, const CallExpr *CE) const {
ProgramStateRef state = C.getState(); ProgramStateRef state = C.getState();
if (!CheckNullStream(state->getSVal(CE->getArg(0), C.getLocationContext()), if (!CheckNullStream(C.getSVal(CE->getArg(0)), state, C))
state, C))
return; return;
} }
void StreamChecker::Fileno(CheckerContext &C, const CallExpr *CE) const { void StreamChecker::Fileno(CheckerContext &C, const CallExpr *CE) const {
ProgramStateRef state = C.getState(); ProgramStateRef state = C.getState();
if (!CheckNullStream(state->getSVal(CE->getArg(0), C.getLocationContext()), if (!CheckNullStream(C.getSVal(CE->getArg(0)), state, C))
state, C))
return; return;
} }
@ -363,8 +352,7 @@ ProgramStateRef StreamChecker::CheckNullStream(SVal SV, ProgramStateRef state,
ProgramStateRef StreamChecker::CheckDoubleClose(const CallExpr *CE, ProgramStateRef StreamChecker::CheckDoubleClose(const CallExpr *CE,
ProgramStateRef state, ProgramStateRef state,
CheckerContext &C) const { CheckerContext &C) const {
SymbolRef Sym = SymbolRef Sym = C.getSVal(CE->getArg(0)).getAsSymbol();
state->getSVal(CE->getArg(0), C.getLocationContext()).getAsSymbol();
if (!Sym) if (!Sym)
return state; return state;

3
lib/StaticAnalyzer/Checkers/TestAfterDivZeroChecker.cpp
View File

@ -114,8 +114,7 @@ DivisionBRVisitor::VisitNode(const ExplodedNode *Succ, const ExplodedNode *Pred,
if (!E) if (!E)
return nullptr; return nullptr;
ProgramStateRef State = Succ->getState(); SVal S = Succ->getSVal(E);
SVal S = State->getSVal(E, Succ->getLocationContext());
if (ZeroSymbol == S.getAsSymbol() && SFC == Succ->getStackFrame()) { if (ZeroSymbol == S.getAsSymbol() && SFC == Succ->getStackFrame()) {
Satisfied = true; Satisfied = true;

2
lib/StaticAnalyzer/Checkers/UndefBranchChecker.cpp
View File

@ -59,7 +59,7 @@ public:
void UndefBranchChecker::checkBranchCondition(const Stmt *Condition, void UndefBranchChecker::checkBranchCondition(const Stmt *Condition,
CheckerContext &Ctx) const { CheckerContext &Ctx) const {
SVal X = Ctx.getState()->getSVal(Condition, Ctx.getLocationContext()); SVal X = Ctx.getSVal(Condition);
if (X.isUndef()) { if (X.isUndef()) {
// Generate a sink node, which implicitly marks both outgoing branches as // Generate a sink node, which implicitly marks both outgoing branches as
// infeasible. // infeasible.

4
lib/StaticAnalyzer/Checkers/UndefCapturedBlockVarChecker.cpp
View File

@ -55,9 +55,7 @@ UndefCapturedBlockVarChecker::checkPostStmt(const BlockExpr *BE,
return; return;
ProgramStateRef state = C.getState(); ProgramStateRef state = C.getState();
const BlockDataRegion *R = auto *R = cast<BlockDataRegion>(C.getSVal(BE).getAsRegion());
cast<BlockDataRegion>(state->getSVal(BE,
C.getLocationContext()).getAsRegion());
BlockDataRegion::referenced_vars_iterator I = R->referenced_vars_begin(), BlockDataRegion::referenced_vars_iterator I = R->referenced_vars_begin(),
E = R->referenced_vars_end(); E = R->referenced_vars_end();

11
lib/StaticAnalyzer/Checkers/UndefResultChecker.cpp
View File

@ -37,12 +37,11 @@ public:
static bool isArrayIndexOutOfBounds(CheckerContext &C, const Expr *Ex) { static bool isArrayIndexOutOfBounds(CheckerContext &C, const Expr *Ex) {
ProgramStateRef state = C.getState(); ProgramStateRef state = C.getState();
const LocationContext *LCtx = C.getLocationContext();
if (!isa<ArraySubscriptExpr>(Ex)) if (!isa<ArraySubscriptExpr>(Ex))
return false; return false;
SVal Loc = state->getSVal(Ex, LCtx); SVal Loc = C.getSVal(Ex);
if (!Loc.isValid()) if (!Loc.isValid())
return false; return false;
@ -66,9 +65,7 @@ static bool isShiftOverflow(const BinaryOperator *B, CheckerContext &C) {
void UndefResultChecker::checkPostStmt(const BinaryOperator *B, void UndefResultChecker::checkPostStmt(const BinaryOperator *B,
CheckerContext &C) const { CheckerContext &C) const {
ProgramStateRef state = C.getState(); if (C.getSVal(B).isUndef()) {
const LocationContext *LCtx = C.getLocationContext();
if (state->getSVal(B, LCtx).isUndef()) {
// Do not report assignments of uninitialized values inside swap functions. // Do not report assignments of uninitialized values inside swap functions.
// This should allow to swap partially uninitialized structs // This should allow to swap partially uninitialized structs
@ -92,11 +89,11 @@ void UndefResultChecker::checkPostStmt(const BinaryOperator *B,
const Expr *Ex = nullptr; const Expr *Ex = nullptr;
bool isLeft = true; bool isLeft = true;
if (state->getSVal(B->getLHS(), LCtx).isUndef()) { if (C.getSVal(B->getLHS()).isUndef()) {
Ex = B->getLHS()->IgnoreParenCasts(); Ex = B->getLHS()->IgnoreParenCasts();
isLeft = true; isLeft = true;
} }
else if (state->getSVal(B->getRHS(), LCtx).isUndef()) { else if (C.getSVal(B->getRHS()).isUndef()) {
Ex = B->getRHS()->IgnoreParenCasts(); Ex = B->getRHS()->IgnoreParenCasts();
isLeft = false; isLeft = false;
} }

3
lib/StaticAnalyzer/Checkers/UndefinedAssignmentChecker.cpp
View File

@ -70,8 +70,7 @@ void UndefinedAssignmentChecker::checkBind(SVal location, SVal val,
if (const BinaryOperator *B = dyn_cast<BinaryOperator>(StoreE)) { if (const BinaryOperator *B = dyn_cast<BinaryOperator>(StoreE)) {
if (B->isCompoundAssignmentOp()) { if (B->isCompoundAssignmentOp()) {
ProgramStateRef state = C.getState(); if (C.getSVal(B->getLHS()).isUndef()) {
if (state->getSVal(B->getLHS(), C.getLocationContext()).isUndef()) {
str = "The left expression of the compound assignment is an " str = "The left expression of the compound assignment is an "
"uninitialized value. The computed value will also be garbage"; "uninitialized value. The computed value will also be garbage";
ex = B->getLHS(); ex = B->getLHS();

9
lib/StaticAnalyzer/Checkers/UnixAPIChecker.cpp
View File

@ -194,7 +194,7 @@ void UnixAPIChecker::CheckOpenVariant(CheckerContext &C,
// Now check if oflags has O_CREAT set. // Now check if oflags has O_CREAT set.
const Expr *oflagsEx = CE->getArg(FlagsArgIndex); const Expr *oflagsEx = CE->getArg(FlagsArgIndex);
const SVal V = state->getSVal(oflagsEx, C.getLocationContext()); const SVal V = C.getSVal(oflagsEx);
if (!V.getAs<NonLoc>()) { if (!V.getAs<NonLoc>()) {
// The case where 'V' can be a location can only be due to a bad header, // The case where 'V' can be a location can only be due to a bad header,
// so in this case bail out. // so in this case bail out.
@ -248,8 +248,7 @@ void UnixAPIChecker::CheckPthreadOnce(CheckerContext &C,
// Check if the first argument is stack allocated. If so, issue a warning // Check if the first argument is stack allocated. If so, issue a warning
// because that's likely to be bad news. // because that's likely to be bad news.
ProgramStateRef state = C.getState(); ProgramStateRef state = C.getState();
const MemRegion *R = const MemRegion *R = C.getSVal(CE->getArg(0)).getAsRegion();
state->getSVal(CE->getArg(0), C.getLocationContext()).getAsRegion();
if (!R || !isa<StackSpaceRegion>(R->getMemorySpace())) if (!R || !isa<StackSpaceRegion>(R->getMemorySpace()))
return; return;
@ -336,7 +335,7 @@ void UnixAPIChecker::BasicAllocationCheck(CheckerContext &C,
ProgramStateRef state = C.getState(); ProgramStateRef state = C.getState();
ProgramStateRef trueState = nullptr, falseState = nullptr; ProgramStateRef trueState = nullptr, falseState = nullptr;
const Expr *arg = CE->getArg(sizeArg); const Expr *arg = CE->getArg(sizeArg);
SVal argVal = state->getSVal(arg, C.getLocationContext()); SVal argVal = C.getSVal(arg);
if (argVal.isUnknownOrUndef()) if (argVal.isUnknownOrUndef())
return; return;
@ -364,7 +363,7 @@ void UnixAPIChecker::CheckCallocZero(CheckerContext &C,
unsigned int i; unsigned int i;
for (i = 0; i < nArgs; i++) { for (i = 0; i < nArgs; i++) {
const Expr *arg = CE->getArg(i); const Expr *arg = CE->getArg(i);
SVal argVal = state->getSVal(arg, C.getLocationContext()); SVal argVal = C.getSVal(arg);
if (argVal.isUnknownOrUndef()) { if (argVal.isUnknownOrUndef()) {
if (i == 0) if (i == 0)
continue; continue;

2
lib/StaticAnalyzer/Checkers/VLASizeChecker.cpp
View File

@ -94,7 +94,7 @@ void VLASizeChecker::checkPreStmt(const DeclStmt *DS, CheckerContext &C) const {
// FIXME: Handle multi-dimensional VLAs. // FIXME: Handle multi-dimensional VLAs.
const Expr *SE = VLA->getSizeExpr(); const Expr *SE = VLA->getSizeExpr();
ProgramStateRef state = C.getState(); ProgramStateRef state = C.getState();
SVal sizeV = state->getSVal(SE, C.getLocationContext()); SVal sizeV = C.getSVal(SE);
if (sizeV.isUndef()) { if (sizeV.isUndef()) {
reportBug(VLA_Garbage, SE, state, C); reportBug(VLA_Garbage, SE, state, C);

2
lib/StaticAnalyzer/Checkers/ValistChecker.cpp
View File

@ -189,7 +189,7 @@ void ValistChecker::checkPreStmt(const VAArgExpr *VAA,
CheckerContext &C) const { CheckerContext &C) const {
ProgramStateRef State = C.getState(); ProgramStateRef State = C.getState();
const Expr *VASubExpr = VAA->getSubExpr(); const Expr *VASubExpr = VAA->getSubExpr();
SVal VAListSVal = State->getSVal(VASubExpr, C.getLocationContext()); SVal VAListSVal = C.getSVal(VASubExpr);
bool Symbolic; bool Symbolic;
const MemRegion *VAList = const MemRegion *VAList =
getVAListAsRegion(VAListSVal, VASubExpr, Symbolic, C); getVAListAsRegion(VAListSVal, VASubExpr, Symbolic, C);

15
lib/StaticAnalyzer/Core/BugReporterVisitors.cpp
View File

@ -235,7 +235,7 @@ public:
// Check the return value. // Check the return value.
ProgramStateRef State = Node->getState(); ProgramStateRef State = Node->getState();
SVal RetVal = State->getSVal(S, Node->getLocationContext()); SVal RetVal = Node->getSVal(S);
// Handle cases where a reference is returned and then immediately used. // Handle cases where a reference is returned and then immediately used.
if (cast<Expr>(S)->isGLValue()) if (cast<Expr>(S)->isGLValue())
@ -717,7 +717,7 @@ FindLastStoreBRVisitor::VisitNode(const ExplodedNode *Succ,
if (VR) { if (VR) {
// See if we can get the BlockVarRegion. // See if we can get the BlockVarRegion.
ProgramStateRef State = StoreSite->getState(); ProgramStateRef State = StoreSite->getState();
SVal V = State->getSVal(S, PS->getLocationContext()); SVal V = StoreSite->getSVal(S);
if (const BlockDataRegion *BDR = if (const BlockDataRegion *BDR =
dyn_cast_or_null<BlockDataRegion>(V.getAsRegion())) { dyn_cast_or_null<BlockDataRegion>(V.getAsRegion())) {
if (const VarRegion *OriginalR = BDR->getOriginalRegion(VR)) { if (const VarRegion *OriginalR = BDR->getOriginalRegion(VR)) {
@ -1104,7 +1104,7 @@ bool bugreporter::trackNullOrUndefValue(const ExplodedNode *N,
if (Inner && ExplodedGraph::isInterestingLValueExpr(Inner)) { if (Inner && ExplodedGraph::isInterestingLValueExpr(Inner)) {
const ExplodedNode *LVNode = findNodeForExpression(N, Inner); const ExplodedNode *LVNode = findNodeForExpression(N, Inner);
ProgramStateRef LVState = LVNode->getState(); ProgramStateRef LVState = LVNode->getState();
SVal LVal = LVState->getSVal(Inner, LVNode->getLocationContext()); SVal LVal = LVNode->getSVal(Inner);
const MemRegion *RR = getLocationRegionIfReference(Inner, N); const MemRegion *RR = getLocationRegionIfReference(Inner, N);
bool LVIsNull = LVState->isNull(LVal).isConstrainedTrue(); bool LVIsNull = LVState->isNull(LVal).isConstrainedTrue();
@ -1123,7 +1123,7 @@ bool bugreporter::trackNullOrUndefValue(const ExplodedNode *N,
// If the LVal is null, check if we are dealing with null reference. // If the LVal is null, check if we are dealing with null reference.
// For those, we want to track the location of the reference. // For those, we want to track the location of the reference.
const MemRegion *R = (RR && LVIsNull) ? RR : const MemRegion *R = (RR && LVIsNull) ? RR :
LVState->getSVal(Inner, LVNode->getLocationContext()).getAsRegion(); LVNode->getSVal(Inner).getAsRegion();
if (R) { if (R) {
// Mark both the variable region and its contents as interesting. // Mark both the variable region and its contents as interesting.
@ -1203,7 +1203,7 @@ const Expr *NilReceiverBRVisitor::getNilReceiver(const Stmt *S,
return nullptr; return nullptr;
if (const Expr *Receiver = ME->getInstanceReceiver()) { if (const Expr *Receiver = ME->getInstanceReceiver()) {
ProgramStateRef state = N->getState(); ProgramStateRef state = N->getState();
SVal V = state->getSVal(Receiver, N->getLocationContext()); SVal V = N->getSVal(Receiver);
if (state->isNull(V).isConstrainedTrue()) if (state->isNull(V).isConstrainedTrue())
return Receiver; return Receiver;
} }
@ -1259,8 +1259,7 @@ void FindLastStoreBRVisitor::registerStatementVarDecls(BugReport &BR,
const Stmt *Head = WorkList.front(); const Stmt *Head = WorkList.front();
WorkList.pop_front(); WorkList.pop_front();
ProgramStateRef state = N->getState(); ProgramStateManager &StateMgr = N->getState()->getStateManager();
ProgramStateManager &StateMgr = state->getStateManager();
if (const DeclRefExpr *DR = dyn_cast<DeclRefExpr>(Head)) { if (const DeclRefExpr *DR = dyn_cast<DeclRefExpr>(Head)) {
if (const VarDecl *VD = dyn_cast<VarDecl>(DR->getDecl())) { if (const VarDecl *VD = dyn_cast<VarDecl>(DR->getDecl())) {
@ -1268,7 +1267,7 @@ void FindLastStoreBRVisitor::registerStatementVarDecls(BugReport &BR,
StateMgr.getRegionManager().getVarRegion(VD, N->getLocationContext()); StateMgr.getRegionManager().getVarRegion(VD, N->getLocationContext());
// What did we load? // What did we load?
SVal V = state->getSVal(S, N->getLocationContext()); SVal V = N->getSVal(S);
if (V.getAs<loc::ConcreteInt>() || V.getAs<nonloc::ConcreteInt>()) { if (V.getAs<loc::ConcreteInt>() || V.getAs<nonloc::ConcreteInt>()) {
// Register a new visitor with the BugReport. // Register a new visitor with the BugReport.

3
lib/StaticAnalyzer/Core/CheckerContext.cpp
View File

@ -20,9 +20,8 @@ using namespace clang;
using namespace ento; using namespace ento;
const FunctionDecl *CheckerContext::getCalleeDecl(const CallExpr *CE) const { const FunctionDecl *CheckerContext::getCalleeDecl(const CallExpr *CE) const {
ProgramStateRef State = getState();
const Expr *Callee = CE->getCallee(); const Expr *Callee = CE->getCallee();
SVal L = State->getSVal(Callee, Pred->getLocationContext()); SVal L = Pred->getSVal(Callee);
return L.getAsFunctionDecl(); return L.getAsFunctionDecl();
} }

8
lib/StaticAnalyzer/Core/PathDiagnostic.cpp
View File

@ -1195,12 +1195,10 @@ std::string StackHintGeneratorForSymbol::getMessage(const ExplodedNode *N){
return getMessageForSymbolNotFound(); return getMessageForSymbolNotFound();
// Check if one of the parameters are set to the interesting symbol. // Check if one of the parameters are set to the interesting symbol.
ProgramStateRef State = N->getState();
const LocationContext *LCtx = N->getLocationContext();
unsigned ArgIndex = 0; unsigned ArgIndex = 0;
for (CallExpr::const_arg_iterator I = CE->arg_begin(), for (CallExpr::const_arg_iterator I = CE->arg_begin(),
E = CE->arg_end(); I != E; ++I, ++ArgIndex){ E = CE->arg_end(); I != E; ++I, ++ArgIndex){
SVal SV = State->getSVal(*I, LCtx); SVal SV = N->getSVal(*I);
// Check if the variable corresponding to the symbol is passed by value. // Check if the variable corresponding to the symbol is passed by value.
SymbolRef AS = SV.getAsLocSymbol(); SymbolRef AS = SV.getAsLocSymbol();
@ -1210,7 +1208,7 @@ std::string StackHintGeneratorForSymbol::getMessage(const ExplodedNode *N){
// Check if the parameter is a pointer to the symbol. // Check if the parameter is a pointer to the symbol.
if (Optional<loc::MemRegionVal> Reg = SV.getAs<loc::MemRegionVal>()) { if (Optional<loc::MemRegionVal> Reg = SV.getAs<loc::MemRegionVal>()) {
SVal PSV = State->getSVal(Reg->getRegion()); SVal PSV = N->getState()->getSVal(Reg->getRegion());
SymbolRef AS = PSV.getAsLocSymbol(); SymbolRef AS = PSV.getAsLocSymbol();
if (AS == Sym) { if (AS == Sym) {
return getMessageForArg(*I, ArgIndex); return getMessageForArg(*I, ArgIndex);
@ -1219,7 +1217,7 @@ std::string StackHintGeneratorForSymbol::getMessage(const ExplodedNode *N){
} }
// Check if we are returning the interesting symbol. // Check if we are returning the interesting symbol.
SVal SV = State->getSVal(CE, LCtx); SVal SV = N->getSVal(CE);
SymbolRef RetSym = SV.getAsLocSymbol(); SymbolRef RetSym = SV.getAsLocSymbol();
if (RetSym == Sym) { if (RetSym == Sym) {
return getMessageForReturn(CE); return getMessageForReturn(CE);