• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 //===---  BugReporter.h - Generate PathDiagnostics --------------*- C++ -*-===//
2 //
3 //                     The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 //  This file defines BugReporter, a utility class for generating
11 //  PathDiagnostics for analyses based on ProgramState.
12 //
13 //===----------------------------------------------------------------------===//
14 
15 #ifndef LLVM_CLANG_STATICANALYZER_CORE_BUGREPORTER_BUGREPORTER_H
16 #define LLVM_CLANG_STATICANALYZER_CORE_BUGREPORTER_BUGREPORTER_H
17 
18 #include "clang/Basic/SourceLocation.h"
19 #include "clang/StaticAnalyzer/Core/AnalyzerOptions.h"
20 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporterVisitor.h"
21 #include "clang/StaticAnalyzer/Core/BugReporter/PathDiagnostic.h"
22 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
23 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
24 #include "llvm/ADT/DenseSet.h"
25 #include "llvm/ADT/FoldingSet.h"
26 #include "llvm/ADT/ImmutableSet.h"
27 #include "llvm/ADT/SmallSet.h"
28 #include "llvm/ADT/ilist.h"
29 #include "llvm/ADT/ilist_node.h"
30 
31 namespace clang {
32 
33 class ASTContext;
34 class DiagnosticsEngine;
35 class Stmt;
36 class ParentMap;
37 
38 namespace ento {
39 
40 class PathDiagnostic;
41 class ExplodedNode;
42 class ExplodedGraph;
43 class BugReport;
44 class BugReporter;
45 class BugReporterContext;
46 class ExprEngine;
47 class BugType;
48 
49 //===----------------------------------------------------------------------===//
50 // Interface for individual bug reports.
51 //===----------------------------------------------------------------------===//
52 
53 /// This class provides an interface through which checkers can create
54 /// individual bug reports.
55 class BugReport : public llvm::ilist_node<BugReport> {
56 public:
57   class NodeResolver {
58     virtual void anchor();
59   public:
~NodeResolver()60     virtual ~NodeResolver() {}
61     virtual const ExplodedNode*
62             getOriginalNode(const ExplodedNode *N) = 0;
63   };
64 
65   typedef const SourceRange *ranges_iterator;
66   typedef SmallVector<std::unique_ptr<BugReporterVisitor>, 8> VisitorList;
67   typedef VisitorList::iterator visitor_iterator;
68   typedef SmallVector<StringRef, 2> ExtraTextList;
69 
70 protected:
71   friend class BugReporter;
72   friend class BugReportEquivClass;
73 
74   BugType& BT;
75   const Decl *DeclWithIssue;
76   std::string ShortDescription;
77   std::string Description;
78   PathDiagnosticLocation Location;
79   PathDiagnosticLocation UniqueingLocation;
80   const Decl *UniqueingDecl;
81 
82   const ExplodedNode *ErrorNode;
83   SmallVector<SourceRange, 4> Ranges;
84   ExtraTextList ExtraText;
85 
86   typedef llvm::DenseSet<SymbolRef> Symbols;
87   typedef llvm::DenseSet<const MemRegion *> Regions;
88 
89   /// A (stack of) a set of symbols that are registered with this
90   /// report as being "interesting", and thus used to help decide which
91   /// diagnostics to include when constructing the final path diagnostic.
92   /// The stack is largely used by BugReporter when generating PathDiagnostics
93   /// for multiple PathDiagnosticConsumers.
94   SmallVector<Symbols *, 2> interestingSymbols;
95 
96   /// A (stack of) set of regions that are registered with this report as being
97   /// "interesting", and thus used to help decide which diagnostics
98   /// to include when constructing the final path diagnostic.
99   /// The stack is largely used by BugReporter when generating PathDiagnostics
100   /// for multiple PathDiagnosticConsumers.
101   SmallVector<Regions *, 2> interestingRegions;
102 
103   /// A set of location contexts that correspoind to call sites which should be
104   /// considered "interesting".
105   llvm::SmallSet<const LocationContext *, 2> InterestingLocationContexts;
106 
107   /// A set of custom visitors which generate "event" diagnostics at
108   /// interesting points in the path.
109   VisitorList Callbacks;
110 
111   /// Used for ensuring the visitors are only added once.
112   llvm::FoldingSet<BugReporterVisitor> CallbacksSet;
113 
114   /// Used for clients to tell if the report's configuration has changed
115   /// since the last time they checked.
116   unsigned ConfigurationChangeToken;
117 
118   /// When set, this flag disables all callstack pruning from a diagnostic
119   /// path.  This is useful for some reports that want maximum fidelty
120   /// when reporting an issue.
121   bool DoNotPrunePath;
122 
123   /// Used to track unique reasons why a bug report might be invalid.
124   ///
125   /// \sa markInvalid
126   /// \sa removeInvalidation
127   typedef std::pair<const void *, const void *> InvalidationRecord;
128 
129   /// If non-empty, this bug report is likely a false positive and should not be
130   /// shown to the user.
131   ///
132   /// \sa markInvalid
133   /// \sa removeInvalidation
134   llvm::SmallSet<InvalidationRecord, 4> Invalidations;
135 
136 private:
137   // Used internally by BugReporter.
138   Symbols &getInterestingSymbols();
139   Regions &getInterestingRegions();
140 
141   void lazyInitializeInterestingSets();
142   void pushInterestingSymbolsAndRegions();
143   void popInterestingSymbolsAndRegions();
144 
145 public:
BugReport(BugType & bt,StringRef desc,const ExplodedNode * errornode)146   BugReport(BugType& bt, StringRef desc, const ExplodedNode *errornode)
147     : BT(bt), DeclWithIssue(nullptr), Description(desc), ErrorNode(errornode),
148       ConfigurationChangeToken(0), DoNotPrunePath(false) {}
149 
BugReport(BugType & bt,StringRef shortDesc,StringRef desc,const ExplodedNode * errornode)150   BugReport(BugType& bt, StringRef shortDesc, StringRef desc,
151             const ExplodedNode *errornode)
152     : BT(bt), DeclWithIssue(nullptr), ShortDescription(shortDesc),
153       Description(desc), ErrorNode(errornode), ConfigurationChangeToken(0),
154       DoNotPrunePath(false) {}
155 
BugReport(BugType & bt,StringRef desc,PathDiagnosticLocation l)156   BugReport(BugType &bt, StringRef desc, PathDiagnosticLocation l)
157     : BT(bt), DeclWithIssue(nullptr), Description(desc), Location(l),
158       ErrorNode(nullptr), ConfigurationChangeToken(0), DoNotPrunePath(false) {}
159 
160   /// \brief Create a BugReport with a custom uniqueing location.
161   ///
162   /// The reports that have the same report location, description, bug type, and
163   /// ranges are uniqued - only one of the equivalent reports will be presented
164   /// to the user. This method allows to rest the location which should be used
165   /// for uniquing reports. For example, memory leaks checker, could set this to
166   /// the allocation site, rather then the location where the bug is reported.
BugReport(BugType & bt,StringRef desc,const ExplodedNode * errornode,PathDiagnosticLocation LocationToUnique,const Decl * DeclToUnique)167   BugReport(BugType& bt, StringRef desc, const ExplodedNode *errornode,
168             PathDiagnosticLocation LocationToUnique, const Decl *DeclToUnique)
169     : BT(bt), DeclWithIssue(nullptr), Description(desc),
170       UniqueingLocation(LocationToUnique),
171       UniqueingDecl(DeclToUnique),
172       ErrorNode(errornode), ConfigurationChangeToken(0),
173       DoNotPrunePath(false) {}
174 
175   virtual ~BugReport();
176 
getBugType()177   const BugType& getBugType() const { return BT; }
getBugType()178   BugType& getBugType() { return BT; }
179 
getErrorNode()180   const ExplodedNode *getErrorNode() const { return ErrorNode; }
181 
getDescription()182   StringRef getDescription() const { return Description; }
183 
184   StringRef getShortDescription(bool UseFallback = true) const {
185     if (ShortDescription.empty() && UseFallback)
186       return Description;
187     return ShortDescription;
188   }
189 
190   /// Indicates whether or not any path pruning should take place
191   /// when generating a PathDiagnostic from this BugReport.
shouldPrunePath()192   bool shouldPrunePath() const { return !DoNotPrunePath; }
193 
194   /// Disable all path pruning when generating a PathDiagnostic.
disablePathPruning()195   void disablePathPruning() { DoNotPrunePath = true; }
196 
197   void markInteresting(SymbolRef sym);
198   void markInteresting(const MemRegion *R);
199   void markInteresting(SVal V);
200   void markInteresting(const LocationContext *LC);
201 
202   bool isInteresting(SymbolRef sym);
203   bool isInteresting(const MemRegion *R);
204   bool isInteresting(SVal V);
205   bool isInteresting(const LocationContext *LC);
206 
getConfigurationChangeToken()207   unsigned getConfigurationChangeToken() const {
208     return ConfigurationChangeToken;
209   }
210 
211   /// Returns whether or not this report should be considered valid.
212   ///
213   /// Invalid reports are those that have been classified as likely false
214   /// positives after the fact.
isValid()215   bool isValid() const {
216     return Invalidations.empty();
217   }
218 
219   /// Marks the current report as invalid, meaning that it is probably a false
220   /// positive and should not be reported to the user.
221   ///
222   /// The \p Tag and \p Data arguments are intended to be opaque identifiers for
223   /// this particular invalidation, where \p Tag represents the visitor
224   /// responsible for invalidation, and \p Data represents the reason this
225   /// visitor decided to invalidate the bug report.
226   ///
227   /// \sa removeInvalidation
markInvalid(const void * Tag,const void * Data)228   void markInvalid(const void *Tag, const void *Data) {
229     Invalidations.insert(std::make_pair(Tag, Data));
230   }
231 
232   /// Reverses the effects of a previous invalidation.
233   ///
234   /// \sa markInvalid
removeInvalidation(const void * Tag,const void * Data)235   void removeInvalidation(const void *Tag, const void *Data) {
236     Invalidations.erase(std::make_pair(Tag, Data));
237   }
238 
239   /// Return the canonical declaration, be it a method or class, where
240   /// this issue semantically occurred.
241   const Decl *getDeclWithIssue() const;
242 
243   /// Specifically set the Decl where an issue occurred.  This isn't necessary
244   /// for BugReports that cover a path as it will be automatically inferred.
setDeclWithIssue(const Decl * declWithIssue)245   void setDeclWithIssue(const Decl *declWithIssue) {
246     DeclWithIssue = declWithIssue;
247   }
248 
249   /// \brief This allows for addition of meta data to the diagnostic.
250   ///
251   /// Currently, only the HTMLDiagnosticClient knows how to display it.
addExtraText(StringRef S)252   void addExtraText(StringRef S) {
253     ExtraText.push_back(S);
254   }
255 
getExtraText()256   virtual const ExtraTextList &getExtraText() {
257     return ExtraText;
258   }
259 
260   /// \brief Return the "definitive" location of the reported bug.
261   ///
262   ///  While a bug can span an entire path, usually there is a specific
263   ///  location that can be used to identify where the key issue occurred.
264   ///  This location is used by clients rendering diagnostics.
265   virtual PathDiagnosticLocation getLocation(const SourceManager &SM) const;
266 
267   /// \brief Get the location on which the report should be uniqued.
getUniqueingLocation()268   PathDiagnosticLocation getUniqueingLocation() const {
269     return UniqueingLocation;
270   }
271 
272   /// \brief Get the declaration containing the uniqueing location.
getUniqueingDecl()273   const Decl *getUniqueingDecl() const {
274     return UniqueingDecl;
275   }
276 
277   const Stmt *getStmt() const;
278 
279   /// \brief Add a range to a bug report.
280   ///
281   /// Ranges are used to highlight regions of interest in the source code.
282   /// They should be at the same source code line as the BugReport location.
283   /// By default, the source range of the statement corresponding to the error
284   /// node will be used; add a single invalid range to specify absence of
285   /// ranges.
addRange(SourceRange R)286   void addRange(SourceRange R) {
287     assert((R.isValid() || Ranges.empty()) && "Invalid range can only be used "
288                            "to specify that the report does not have a range.");
289     Ranges.push_back(R);
290   }
291 
292   /// \brief Get the SourceRanges associated with the report.
293   virtual llvm::iterator_range<ranges_iterator> getRanges();
294 
295   /// \brief Add custom or predefined bug report visitors to this report.
296   ///
297   /// The visitors should be used when the default trace is not sufficient.
298   /// For example, they allow constructing a more elaborate trace.
299   /// \sa registerConditionVisitor(), registerTrackNullOrUndefValue(),
300   /// registerFindLastStore(), registerNilReceiverVisitor(), and
301   /// registerVarDeclsLastStore().
302   void addVisitor(std::unique_ptr<BugReporterVisitor> visitor);
303 
304   /// Iterators through the custom diagnostic visitors.
visitor_begin()305   visitor_iterator visitor_begin() { return Callbacks.begin(); }
visitor_end()306   visitor_iterator visitor_end() { return Callbacks.end(); }
307 
308   /// Profile to identify equivalent bug reports for error report coalescing.
309   /// Reports are uniqued to ensure that we do not emit multiple diagnostics
310   /// for each bug.
311   virtual void Profile(llvm::FoldingSetNodeID& hash) const;
312 };
313 
314 } // end ento namespace
315 } // end clang namespace
316 
317 namespace llvm {
318   template<> struct ilist_traits<clang::ento::BugReport>
319     : public ilist_default_traits<clang::ento::BugReport> {
320     clang::ento::BugReport *createSentinel() const {
321       return static_cast<clang::ento::BugReport *>(&Sentinel);
322     }
323     void destroySentinel(clang::ento::BugReport *) const {}
324 
325     clang::ento::BugReport *provideInitialHead() const {
326       return createSentinel();
327     }
328     clang::ento::BugReport *ensureHead(clang::ento::BugReport *) const {
329       return createSentinel();
330     }
331   private:
332     mutable ilist_half_node<clang::ento::BugReport> Sentinel;
333   };
334 }
335 
336 namespace clang {
337 namespace ento {
338 
339 //===----------------------------------------------------------------------===//
340 // BugTypes (collections of related reports).
341 //===----------------------------------------------------------------------===//
342 
343 class BugReportEquivClass : public llvm::FoldingSetNode {
344   /// List of *owned* BugReport objects.
345   llvm::ilist<BugReport> Reports;
346 
347   friend class BugReporter;
348   void AddReport(std::unique_ptr<BugReport> R) {
349     Reports.push_back(R.release());
350   }
351 
352 public:
353   BugReportEquivClass(std::unique_ptr<BugReport> R) { AddReport(std::move(R)); }
354   ~BugReportEquivClass();
355 
356   void Profile(llvm::FoldingSetNodeID& ID) const {
357     assert(!Reports.empty());
358     Reports.front().Profile(ID);
359   }
360 
361   typedef llvm::ilist<BugReport>::iterator iterator;
362   typedef llvm::ilist<BugReport>::const_iterator const_iterator;
363 
364   iterator begin() { return Reports.begin(); }
365   iterator end() { return Reports.end(); }
366 
367   const_iterator begin() const { return Reports.begin(); }
368   const_iterator end() const { return Reports.end(); }
369 };
370 
371 //===----------------------------------------------------------------------===//
372 // BugReporter and friends.
373 //===----------------------------------------------------------------------===//
374 
375 class BugReporterData {
376 public:
377   virtual ~BugReporterData();
378   virtual DiagnosticsEngine& getDiagnostic() = 0;
379   virtual ArrayRef<PathDiagnosticConsumer*> getPathDiagnosticConsumers() = 0;
380   virtual ASTContext &getASTContext() = 0;
381   virtual SourceManager& getSourceManager() = 0;
382   virtual AnalyzerOptions& getAnalyzerOptions() = 0;
383 };
384 
385 /// BugReporter is a utility class for generating PathDiagnostics for analysis.
386 /// It collects the BugReports and BugTypes and knows how to generate
387 /// and flush the corresponding diagnostics.
388 class BugReporter {
389 public:
390   enum Kind { BaseBRKind, GRBugReporterKind };
391 
392 private:
393   typedef llvm::ImmutableSet<BugType*> BugTypesTy;
394   BugTypesTy::Factory F;
395   BugTypesTy BugTypes;
396 
397   const Kind kind;
398   BugReporterData& D;
399 
400   /// Generate and flush the diagnostics for the given bug report.
401   void FlushReport(BugReportEquivClass& EQ);
402 
403   /// Generate and flush the diagnostics for the given bug report
404   /// and PathDiagnosticConsumer.
405   void FlushReport(BugReport *exampleReport,
406                    PathDiagnosticConsumer &PD,
407                    ArrayRef<BugReport*> BugReports);
408 
409   /// The set of bug reports tracked by the BugReporter.
410   llvm::FoldingSet<BugReportEquivClass> EQClasses;
411   /// A vector of BugReports for tracking the allocated pointers and cleanup.
412   std::vector<BugReportEquivClass *> EQClassesVector;
413 
414 protected:
415   BugReporter(BugReporterData& d, Kind k) : BugTypes(F.getEmptySet()), kind(k),
416                                             D(d) {}
417 
418 public:
419   BugReporter(BugReporterData& d) : BugTypes(F.getEmptySet()), kind(BaseBRKind),
420                                     D(d) {}
421   virtual ~BugReporter();
422 
423   /// \brief Generate and flush diagnostics for all bug reports.
424   void FlushReports();
425 
426   Kind getKind() const { return kind; }
427 
428   DiagnosticsEngine& getDiagnostic() {
429     return D.getDiagnostic();
430   }
431 
432   ArrayRef<PathDiagnosticConsumer*> getPathDiagnosticConsumers() {
433     return D.getPathDiagnosticConsumers();
434   }
435 
436   /// \brief Iterator over the set of BugTypes tracked by the BugReporter.
437   typedef BugTypesTy::iterator iterator;
438   iterator begin() { return BugTypes.begin(); }
439   iterator end() { return BugTypes.end(); }
440 
441   /// \brief Iterator over the set of BugReports tracked by the BugReporter.
442   typedef llvm::FoldingSet<BugReportEquivClass>::iterator EQClasses_iterator;
443   EQClasses_iterator EQClasses_begin() { return EQClasses.begin(); }
444   EQClasses_iterator EQClasses_end() { return EQClasses.end(); }
445 
446   ASTContext &getContext() { return D.getASTContext(); }
447 
448   SourceManager& getSourceManager() { return D.getSourceManager(); }
449 
450   AnalyzerOptions& getAnalyzerOptions() { return D.getAnalyzerOptions(); }
451 
452   virtual bool generatePathDiagnostic(PathDiagnostic& pathDiagnostic,
453                                       PathDiagnosticConsumer &PC,
454                                       ArrayRef<BugReport *> &bugReports) {
455     return true;
456   }
457 
458   bool RemoveUnneededCalls(PathPieces &pieces, BugReport *R);
459 
460   void Register(BugType *BT);
461 
462   /// \brief Add the given report to the set of reports tracked by BugReporter.
463   ///
464   /// The reports are usually generated by the checkers. Further, they are
465   /// folded based on the profile value, which is done to coalesce similar
466   /// reports.
467   void emitReport(std::unique_ptr<BugReport> R);
468 
469   void EmitBasicReport(const Decl *DeclWithIssue, const CheckerBase *Checker,
470                        StringRef BugName, StringRef BugCategory,
471                        StringRef BugStr, PathDiagnosticLocation Loc,
472                        ArrayRef<SourceRange> Ranges = None);
473 
474   void EmitBasicReport(const Decl *DeclWithIssue, CheckName CheckName,
475                        StringRef BugName, StringRef BugCategory,
476                        StringRef BugStr, PathDiagnosticLocation Loc,
477                        ArrayRef<SourceRange> Ranges = None);
478 
479 private:
480   llvm::StringMap<BugType *> StrBugTypes;
481 
482   /// \brief Returns a BugType that is associated with the given name and
483   /// category.
484   BugType *getBugTypeForName(CheckName CheckName, StringRef name,
485                              StringRef category);
486 };
487 
488 // FIXME: Get rid of GRBugReporter.  It's the wrong abstraction.
489 class GRBugReporter : public BugReporter {
490   ExprEngine& Eng;
491 public:
492   GRBugReporter(BugReporterData& d, ExprEngine& eng)
493     : BugReporter(d, GRBugReporterKind), Eng(eng) {}
494 
495   ~GRBugReporter() override;
496 
497   /// getEngine - Return the analysis engine used to analyze a given
498   ///  function or method.
499   ExprEngine &getEngine() { return Eng; }
500 
501   /// getGraph - Get the exploded graph created by the analysis engine
502   ///  for the analyzed method or function.
503   ExplodedGraph &getGraph();
504 
505   /// getStateManager - Return the state manager used by the analysis
506   ///  engine.
507   ProgramStateManager &getStateManager();
508 
509   /// Generates a path corresponding to one of the given bug reports.
510   ///
511   /// Which report is used for path generation is not specified. The
512   /// bug reporter will try to pick the shortest path, but this is not
513   /// guaranteed.
514   ///
515   /// \return True if the report was valid and a path was generated,
516   ///         false if the reports should be considered invalid.
517   bool generatePathDiagnostic(PathDiagnostic &PD, PathDiagnosticConsumer &PC,
518                               ArrayRef<BugReport*> &bugReports) override;
519 
520   /// classof - Used by isa<>, cast<>, and dyn_cast<>.
521   static bool classof(const BugReporter* R) {
522     return R->getKind() == GRBugReporterKind;
523   }
524 };
525 
526 class BugReporterContext {
527   virtual void anchor();
528   GRBugReporter &BR;
529 public:
530   BugReporterContext(GRBugReporter& br) : BR(br) {}
531 
532   virtual ~BugReporterContext() {}
533 
534   GRBugReporter& getBugReporter() { return BR; }
535 
536   ExplodedGraph &getGraph() { return BR.getGraph(); }
537 
538   ProgramStateManager& getStateManager() {
539     return BR.getStateManager();
540   }
541 
542   SValBuilder& getSValBuilder() {
543     return getStateManager().getSValBuilder();
544   }
545 
546   ASTContext &getASTContext() {
547     return BR.getContext();
548   }
549 
550   SourceManager& getSourceManager() {
551     return BR.getSourceManager();
552   }
553 
554   virtual BugReport::NodeResolver& getNodeResolver() = 0;
555 };
556 
557 } // end GR namespace
558 
559 } // end clang namespace
560 
561 #endif
562