[cfe-commits] r85911 - in /cfe/trunk: include/clang/Analysis/PathSensitive/Checkers/DereferenceChecker.h include/clang/Analysis/PathSensitive/Checkers/NullDerefChecker.h include/clang/Analysis/PathSensitive/Checkers/UndefDerefChecker.h lib/Analysis/CMakeLists.txt lib/Analysis/DereferenceChecker.cpp lib/Analysis/GRExprEngineInternalChecks.cpp lib/Analysis/NSErrorChecker.cpp lib/Analysis/NullDerefChecker.cpp lib/Analysis/UndefDerefChecker.cpp

Ted Kremenek kremenek at apple.com
Tue Nov 3 10:41:07 PST 2009


Author: kremenek
Date: Tue Nov  3 12:41:06 2009
New Revision: 85911

URL: http://llvm.org/viewvc/llvm-project?rev=85911&view=rev
Log:
Merge NullDerefChecker.[h,cpp] and UndefDerefChecker.[h,cpp].  They are essentially two parts of the same check.

Added:
    cfe/trunk/include/clang/Analysis/PathSensitive/Checkers/DereferenceChecker.h
      - copied, changed from r85910, cfe/trunk/include/clang/Analysis/PathSensitive/Checkers/NullDerefChecker.h
    cfe/trunk/lib/Analysis/DereferenceChecker.cpp
      - copied, changed from r85910, cfe/trunk/lib/Analysis/NullDerefChecker.cpp
Removed:
    cfe/trunk/include/clang/Analysis/PathSensitive/Checkers/NullDerefChecker.h
    cfe/trunk/include/clang/Analysis/PathSensitive/Checkers/UndefDerefChecker.h
    cfe/trunk/lib/Analysis/NullDerefChecker.cpp
    cfe/trunk/lib/Analysis/UndefDerefChecker.cpp
Modified:
    cfe/trunk/lib/Analysis/CMakeLists.txt
    cfe/trunk/lib/Analysis/GRExprEngineInternalChecks.cpp
    cfe/trunk/lib/Analysis/NSErrorChecker.cpp

Copied: cfe/trunk/include/clang/Analysis/PathSensitive/Checkers/DereferenceChecker.h (from r85910, cfe/trunk/include/clang/Analysis/PathSensitive/Checkers/NullDerefChecker.h)
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/include/clang/Analysis/PathSensitive/Checkers/DereferenceChecker.h?p2=cfe/trunk/include/clang/Analysis/PathSensitive/Checkers/DereferenceChecker.h&p1=cfe/trunk/include/clang/Analysis/PathSensitive/Checkers/NullDerefChecker.h&r1=85910&r2=85911&rev=85911&view=diff

==============================================================================
--- cfe/trunk/include/clang/Analysis/PathSensitive/Checkers/NullDerefChecker.h (original)
+++ cfe/trunk/include/clang/Analysis/PathSensitive/Checkers/DereferenceChecker.h Tue Nov  3 12:41:06 2009
@@ -7,13 +7,14 @@
 //
 //===----------------------------------------------------------------------===//
 //
-// This defines NullDerefChecker, a builtin check in GRExprEngine that performs
-// checks for null pointers at loads and stores.
+// This defines NullDerefChecker and UndefDerefChecker, two builtin checks
+// in GRExprEngine that check for null and undefined pointers at loads
+// and stores.
 //
 //===----------------------------------------------------------------------===//
 
-#ifndef LLVM_CLANG_NULLDEREFCHECKER
-#define LLVM_CLANG_NULLDEREFCHECKER
+#ifndef LLVM_CLANG_DEREFCHECKER
+#define LLVM_CLANG_DEREFCHECKER
 
 #include "clang/Analysis/PathSensitive/Checker.h"
 #include "clang/Analysis/PathSensitive/BugType.h"
@@ -37,5 +38,16 @@
   iterator implicit_nodes_end() { return ImplicitNullDerefNodes.end(); }
 };
 
+class UndefDerefChecker : public Checker {
+  BuiltinBug *BT;
+public:
+  UndefDerefChecker() : BT(0) {}
+
+  ExplodedNode *CheckLocation(const Stmt *S, ExplodedNode *Pred,
+                              const GRState *state, SVal V, GRExprEngine &Eng);
+
+  static void *getTag();
+};
+
 } // end clang namespace
 #endif

Removed: cfe/trunk/include/clang/Analysis/PathSensitive/Checkers/NullDerefChecker.h
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/include/clang/Analysis/PathSensitive/Checkers/NullDerefChecker.h?rev=85910&view=auto

==============================================================================
--- cfe/trunk/include/clang/Analysis/PathSensitive/Checkers/NullDerefChecker.h (original)
+++ cfe/trunk/include/clang/Analysis/PathSensitive/Checkers/NullDerefChecker.h (removed)
@@ -1,41 +0,0 @@
-//== NullDerefChecker.h - Null dereference checker --------------*- C++ -*--==//
-//
-//                     The LLVM Compiler Infrastructure
-//
-// This file is distributed under the University of Illinois Open Source
-// License. See LICENSE.TXT for details.
-//
-//===----------------------------------------------------------------------===//
-//
-// This defines NullDerefChecker, a builtin check in GRExprEngine that performs
-// checks for null pointers at loads and stores.
-//
-//===----------------------------------------------------------------------===//
-
-#ifndef LLVM_CLANG_NULLDEREFCHECKER
-#define LLVM_CLANG_NULLDEREFCHECKER
-
-#include "clang/Analysis/PathSensitive/Checker.h"
-#include "clang/Analysis/PathSensitive/BugType.h"
-
-namespace clang {
-
-class ExplodedNode;
-
-class NullDerefChecker : public Checker {
-  BuiltinBug *BT;
-  llvm::SmallVector<ExplodedNode*, 2> ImplicitNullDerefNodes;
-
-public:
-  NullDerefChecker() : BT(0) {}
-  ExplodedNode *CheckLocation(const Stmt *S, ExplodedNode *Pred,
-                              const GRState *state, SVal V,GRExprEngine &Eng);
-
-  static void *getTag();
-  typedef llvm::SmallVectorImpl<ExplodedNode*>::iterator iterator;
-  iterator implicit_nodes_begin() { return ImplicitNullDerefNodes.begin(); }
-  iterator implicit_nodes_end() { return ImplicitNullDerefNodes.end(); }
-};
-
-} // end clang namespace
-#endif

Removed: cfe/trunk/include/clang/Analysis/PathSensitive/Checkers/UndefDerefChecker.h
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/include/clang/Analysis/PathSensitive/Checkers/UndefDerefChecker.h?rev=85910&view=auto

==============================================================================
--- cfe/trunk/include/clang/Analysis/PathSensitive/Checkers/UndefDerefChecker.h (original)
+++ cfe/trunk/include/clang/Analysis/PathSensitive/Checkers/UndefDerefChecker.h (removed)
@@ -1,31 +0,0 @@
-//== UndefDerefChecker.h - Undefined dereference checker --------*- C++ -*--==//
-//
-//                     The LLVM Compiler Infrastructure
-//
-// This file is distributed under the University of Illinois Open Source
-// License. See LICENSE.TXT for details.
-//
-//===----------------------------------------------------------------------===//
-//
-// This defines UndefDerefChecker, a builtin check in GRExprEngine that performs
-// checks for defined pointers at loads and stores.
-//
-//===----------------------------------------------------------------------===//
-
-#include "clang/Analysis/PathSensitive/Checker.h"
-#include "clang/Analysis/PathSensitive/BugType.h"
-
-namespace clang {
-
-class UndefDerefChecker : public Checker {
-  BuiltinBug *BT;
-public:
-  UndefDerefChecker() : BT(0) {}
-
-  ExplodedNode *CheckLocation(const Stmt *S, ExplodedNode *Pred,
-                              const GRState *state, SVal V, GRExprEngine &Eng);
-
-  static void *getTag();
-};
-
-}

Modified: cfe/trunk/lib/Analysis/CMakeLists.txt
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/Analysis/CMakeLists.txt?rev=85911&r1=85910&r2=85911&view=diff

==============================================================================
--- cfe/trunk/lib/Analysis/CMakeLists.txt (original)
+++ cfe/trunk/lib/Analysis/CMakeLists.txt Tue Nov  3 12:41:06 2009
@@ -20,6 +20,7 @@
   CheckObjCInstMethSignature.cpp
   CheckObjCUnusedIVars.cpp
   CheckSecuritySyntaxOnly.cpp
+  DereferenceChecker.cpp
   DivZeroChecker.cpp
   Environment.cpp
   ExplodedGraph.cpp
@@ -32,7 +33,6 @@
   MemRegion.cpp
   NSAutoreleasePoolChecker.cpp
   NSErrorChecker.cpp
-  NullDerefChecker.cpp
   PathDiagnostic.cpp
   RangeConstraintManager.cpp
   RegionStore.cpp
@@ -42,7 +42,6 @@
   SimpleSValuator.cpp
   Store.cpp
   SymbolManager.cpp
-  UndefDerefChecker.cpp
   UndefSizedVLAChecker.cpp
   UndefinedArgChecker.cpp
   UninitializedValues.cpp

Copied: cfe/trunk/lib/Analysis/DereferenceChecker.cpp (from r85910, cfe/trunk/lib/Analysis/NullDerefChecker.cpp)
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/Analysis/DereferenceChecker.cpp?p2=cfe/trunk/lib/Analysis/DereferenceChecker.cpp&p1=cfe/trunk/lib/Analysis/NullDerefChecker.cpp&r1=85910&r2=85911&rev=85911&view=diff

==============================================================================
--- cfe/trunk/lib/Analysis/NullDerefChecker.cpp (original)
+++ cfe/trunk/lib/Analysis/DereferenceChecker.cpp Tue Nov  3 12:41:06 2009
@@ -12,7 +12,7 @@
 //
 //===----------------------------------------------------------------------===//
 
-#include "clang/Analysis/PathSensitive/Checkers/NullDerefChecker.h"
+#include "clang/Analysis/PathSensitive/Checkers/DereferenceChecker.h"
 #include "clang/Analysis/PathSensitive/GRExprEngine.h"
 #include "clang/Analysis/PathSensitive/BugReporter.h"
 
@@ -74,3 +74,39 @@
   return Builder.generateNode(S, NotNullState, Pred, 
                               ProgramPoint::PostLocationChecksSucceedKind);
 }
+
+
+void *UndefDerefChecker::getTag() {
+  static int x = 0;
+  return &x;
+}
+
+ExplodedNode *UndefDerefChecker::CheckLocation(const Stmt *S, 
+                                               ExplodedNode *Pred,
+                                               const GRState *state, SVal V,
+                                               GRExprEngine &Eng) {
+  GRStmtNodeBuilder &Builder = Eng.getBuilder();
+  BugReporter &BR = Eng.getBugReporter();
+
+  if (V.isUndef()) {
+    ExplodedNode *N = Builder.generateNode(S, state, Pred, 
+                               ProgramPoint::PostUndefLocationCheckFailedKind);
+    if (N) {
+      N->markAsSink();
+
+      if (!BT)
+        BT = new BuiltinBug(0, "Undefined dereference", 
+                            "Dereference of undefined pointer value");
+
+      EnhancedBugReport *R =
+        new EnhancedBugReport(*BT, BT->getDescription().c_str(), N);
+      R->addVisitorCreator(bugreporter::registerTrackNullOrUndefValue,
+                           bugreporter::GetDerefExpr(N));
+      BR.EmitReport(R);
+    }
+    return 0;
+  }
+
+  return Pred;
+}
+

Modified: cfe/trunk/lib/Analysis/GRExprEngineInternalChecks.cpp
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/Analysis/GRExprEngineInternalChecks.cpp?rev=85911&r1=85910&r2=85911&view=diff

==============================================================================
--- cfe/trunk/lib/Analysis/GRExprEngineInternalChecks.cpp (original)
+++ cfe/trunk/lib/Analysis/GRExprEngineInternalChecks.cpp Tue Nov  3 12:41:06 2009
@@ -15,8 +15,7 @@
 #include "clang/Analysis/PathSensitive/BugReporter.h"
 #include "clang/Analysis/PathSensitive/GRExprEngine.h"
 #include "clang/Analysis/PathSensitive/CheckerVisitor.h"
-#include "clang/Analysis/PathSensitive/Checkers/NullDerefChecker.h"
-#include "clang/Analysis/PathSensitive/Checkers/UndefDerefChecker.h"
+#include "clang/Analysis/PathSensitive/Checkers/DereferenceChecker.h"
 #include "clang/Analysis/PathSensitive/Checkers/DivZeroChecker.h"
 #include "clang/Analysis/PathSensitive/Checkers/BadCallChecker.h"
 #include "clang/Analysis/PathSensitive/Checkers/UndefinedArgChecker.h"

Modified: cfe/trunk/lib/Analysis/NSErrorChecker.cpp
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/Analysis/NSErrorChecker.cpp?rev=85911&r1=85910&r2=85911&view=diff

==============================================================================
--- cfe/trunk/lib/Analysis/NSErrorChecker.cpp (original)
+++ cfe/trunk/lib/Analysis/NSErrorChecker.cpp Tue Nov  3 12:41:06 2009
@@ -18,7 +18,7 @@
 #include "clang/Analysis/LocalCheckers.h"
 #include "clang/Analysis/PathSensitive/BugReporter.h"
 #include "clang/Analysis/PathSensitive/GRExprEngine.h"
-#include "clang/Analysis/PathSensitive/Checkers/NullDerefChecker.h"
+#include "clang/Analysis/PathSensitive/Checkers/DereferenceChecker.h"
 #include "BasicObjCFoundationChecks.h"
 #include "llvm/Support/Compiler.h"
 #include "clang/AST/DeclObjC.h"

Removed: cfe/trunk/lib/Analysis/NullDerefChecker.cpp
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/Analysis/NullDerefChecker.cpp?rev=85910&view=auto

==============================================================================
--- cfe/trunk/lib/Analysis/NullDerefChecker.cpp (original)
+++ cfe/trunk/lib/Analysis/NullDerefChecker.cpp (removed)
@@ -1,76 +0,0 @@
-//== NullDerefChecker.cpp - Null dereference checker ------------*- C++ -*--==//
-//
-//                     The LLVM Compiler Infrastructure
-//
-// This file is distributed under the University of Illinois Open Source
-// License. See LICENSE.TXT for details.
-//
-//===----------------------------------------------------------------------===//
-//
-// This defines NullDerefChecker, a builtin check in GRExprEngine that performs
-// checks for null pointers at loads and stores.
-//
-//===----------------------------------------------------------------------===//
-
-#include "clang/Analysis/PathSensitive/Checkers/NullDerefChecker.h"
-#include "clang/Analysis/PathSensitive/GRExprEngine.h"
-#include "clang/Analysis/PathSensitive/BugReporter.h"
-
-using namespace clang;
-
-void *NullDerefChecker::getTag() {
-  static int x = 0;
-  return &x;
-}
-
-ExplodedNode *NullDerefChecker::CheckLocation(const Stmt *S, ExplodedNode *Pred,
-                                              const GRState *state, SVal V,
-                                              GRExprEngine &Eng) {
-  Loc *LV = dyn_cast<Loc>(&V);
-  
-    // If the value is not a location, don't touch the node.
-  if (!LV)
-    return Pred;
-  
-  const GRState *NotNullState = state->Assume(*LV, true);
-  const GRState *NullState = state->Assume(*LV, false);
-  
-  GRStmtNodeBuilder &Builder = Eng.getBuilder();
-  BugReporter &BR = Eng.getBugReporter();
-  
-    // The explicit NULL case.
-  if (NullState) {
-      // Use the GDM to mark in the state what lval was null.
-    const SVal *PersistentLV = Eng.getBasicVals().getPersistentSVal(*LV);
-    NullState = NullState->set<GRState::NullDerefTag>(PersistentLV);
-    
-    ExplodedNode *N = Builder.generateNode(S, NullState, Pred,
-                                         ProgramPoint::PostNullCheckFailedKind);
-    if (N) {
-      N->markAsSink();
-      
-      if (!NotNullState) { // Explicit null case.
-        if (!BT)
-          BT = new BuiltinBug(NULL, "Null dereference",
-                              "Dereference of null pointer");
-
-        EnhancedBugReport *R =
-          new EnhancedBugReport(*BT, BT->getDescription().c_str(), N);
-        
-        R->addVisitorCreator(bugreporter::registerTrackNullOrUndefValue,
-                             bugreporter::GetDerefExpr(N));
-        
-        BR.EmitReport(R);
-        
-        return 0;
-      } else // Implicit null case.
-        ImplicitNullDerefNodes.push_back(N);
-    }
-  }
-  
-  if (!NotNullState)
-    return 0;
-
-  return Builder.generateNode(S, NotNullState, Pred, 
-                              ProgramPoint::PostLocationChecksSucceedKind);
-}

Removed: cfe/trunk/lib/Analysis/UndefDerefChecker.cpp
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/Analysis/UndefDerefChecker.cpp?rev=85910&view=auto

==============================================================================
--- cfe/trunk/lib/Analysis/UndefDerefChecker.cpp (original)
+++ cfe/trunk/lib/Analysis/UndefDerefChecker.cpp (removed)
@@ -1,53 +0,0 @@
-// UndefDerefChecker.cpp - Undefined dereference checker ----------*- C++ -*--//
-//
-//                     The LLVM Compiler Infrastructure
-//
-// This file is distributed under the University of Illinois Open Source
-// License. See LICENSE.TXT for details.
-//
-//===----------------------------------------------------------------------===//
-//
-// This defines UndefDerefChecker, a builtin check in GRExprEngine that performs
-// checks for defined pointers at loads and stores.
-//
-//===----------------------------------------------------------------------===//
-
-#include "clang/Analysis/PathSensitive/Checkers/UndefDerefChecker.h"
-#include "clang/Analysis/PathSensitive/GRExprEngine.h"
-#include "clang/Analysis/PathSensitive/BugReporter.h"
-
-using namespace clang;
-
-void *UndefDerefChecker::getTag() {
-  static int x = 0;
-  return &x;
-}
-
-ExplodedNode *UndefDerefChecker::CheckLocation(const Stmt *S, 
-                                               ExplodedNode *Pred,
-                                               const GRState *state, SVal V,
-                                               GRExprEngine &Eng) {
-  GRStmtNodeBuilder &Builder = Eng.getBuilder();
-  BugReporter &BR = Eng.getBugReporter();
-
-  if (V.isUndef()) {
-    ExplodedNode *N = Builder.generateNode(S, state, Pred, 
-                               ProgramPoint::PostUndefLocationCheckFailedKind);
-    if (N) {
-      N->markAsSink();
-
-      if (!BT)
-        BT = new BuiltinBug(0, "Undefined dereference", 
-                            "Dereference of undefined pointer value");
-
-      EnhancedBugReport *R =
-        new EnhancedBugReport(*BT, BT->getDescription().c_str(), N);
-      R->addVisitorCreator(bugreporter::registerTrackNullOrUndefValue,
-                           bugreporter::GetDerefExpr(N));
-      BR.EmitReport(R);
-    }
-    return 0;
-  }
-
-  return Pred;
-}





More information about the cfe-commits mailing list