BugReporter.h revision 263508
1279377Simp//===--- BugReporter.h - Generate PathDiagnostics --------------*- C++ -*-===// 2279377Simp// 3279377Simp// The LLVM Compiler Infrastructure 4279377Simp// 5279377Simp// This file is distributed under the University of Illinois Open Source 6279377Simp// License. See LICENSE.TXT for details. 7279377Simp// 8279377Simp//===----------------------------------------------------------------------===// 9279377Simp// 10279377Simp// This file defines BugReporter, a utility class for generating 11279377Simp// PathDiagnostics for analyses based on ProgramState. 12279377Simp// 13279377Simp//===----------------------------------------------------------------------===// 14279377Simp 15279377Simp#ifndef LLVM_CLANG_GR_BUGREPORTER 16279377Simp#define LLVM_CLANG_GR_BUGREPORTER 17279377Simp 18279377Simp#include "clang/Basic/SourceLocation.h" 19279377Simp#include "clang/StaticAnalyzer/Core/AnalyzerOptions.h" 20279377Simp#include "clang/StaticAnalyzer/Core/BugReporter/BugReporterVisitor.h" 21279377Simp#include "clang/StaticAnalyzer/Core/BugReporter/PathDiagnostic.h" 22279377Simp#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h" 23279377Simp#include "llvm/ADT/DenseSet.h" 24279377Simp#include "llvm/ADT/FoldingSet.h" 25279377Simp#include "llvm/ADT/ImmutableSet.h" 26279377Simp#include "llvm/ADT/SmallSet.h" 27279377Simp#include "llvm/ADT/ilist.h" 28279377Simp#include "llvm/ADT/ilist_node.h" 29279377Simp 30279377Simpnamespace clang { 31279377Simp 32279377Simpclass ASTContext; 33279377Simpclass DiagnosticsEngine; 34279377Simpclass Stmt; 35279377Simpclass ParentMap; 36279377Simp 37279377Simpnamespace ento { 38279377Simp 39279377Simpclass PathDiagnostic; 40279377Simpclass ExplodedNode; 41279377Simpclass ExplodedGraph; 42279377Simpclass BugReport; 43279377Simpclass BugReporter; 44279377Simpclass BugReporterContext; 45279377Simpclass ExprEngine; 46279377Simpclass BugType; 47279377Simp 48279377Simp//===----------------------------------------------------------------------===// 49279377Simp// Interface for individual bug reports. 50279377Simp//===----------------------------------------------------------------------===// 51279377Simp 52279377Simp/// This class provides an interface through which checkers can create 53279377Simp/// individual bug reports. 54279377Simpclass BugReport : public llvm::ilist_node<BugReport> { 55279377Simppublic: 56279377Simp class NodeResolver { 57279377Simp virtual void anchor(); 58279377Simp public: 59279377Simp virtual ~NodeResolver() {} 60279377Simp virtual const ExplodedNode* 61279377Simp getOriginalNode(const ExplodedNode *N) = 0; 62279377Simp }; 63279377Simp 64279377Simp typedef const SourceRange *ranges_iterator; 65279377Simp typedef SmallVector<BugReporterVisitor *, 8> VisitorList; 66279377Simp typedef VisitorList::iterator visitor_iterator; 67279377Simp typedef SmallVector<StringRef, 2> ExtraTextList; 68279377Simp 69279377Simpprotected: 70279377Simp friend class BugReporter; 71279377Simp friend class BugReportEquivClass; 72279377Simp 73279377Simp BugType& BT; 74279377Simp const Decl *DeclWithIssue; 75279377Simp std::string ShortDescription; 76279377Simp std::string Description; 77279377Simp PathDiagnosticLocation Location; 78279377Simp PathDiagnosticLocation UniqueingLocation; 79279377Simp const Decl *UniqueingDecl; 80279377Simp 81279377Simp const ExplodedNode *ErrorNode; 82279377Simp SmallVector<SourceRange, 4> Ranges; 83279377Simp ExtraTextList ExtraText; 84279377Simp 85279377Simp typedef llvm::DenseSet<SymbolRef> Symbols; 86279377Simp typedef llvm::DenseSet<const MemRegion *> Regions; 87279377Simp 88279377Simp /// A (stack of) a set of symbols that are registered with this 89279377Simp /// report as being "interesting", and thus used to help decide which 90279377Simp /// diagnostics to include when constructing the final path diagnostic. 91279377Simp /// The stack is largely used by BugReporter when generating PathDiagnostics 92279377Simp /// for multiple PathDiagnosticConsumers. 93279377Simp SmallVector<Symbols *, 2> interestingSymbols; 94279377Simp 95279377Simp /// A (stack of) set of regions that are registered with this report as being 96279377Simp /// "interesting", and thus used to help decide which diagnostics 97279377Simp /// to include when constructing the final path diagnostic. 98279377Simp /// The stack is largely used by BugReporter when generating PathDiagnostics 99279377Simp /// for multiple PathDiagnosticConsumers. 100279377Simp SmallVector<Regions *, 2> interestingRegions; 101279377Simp 102279377Simp /// A set of location contexts that correspoind to call sites which should be 103279377Simp /// considered "interesting". 104279377Simp llvm::SmallSet<const LocationContext *, 2> InterestingLocationContexts; 105279377Simp 106279377Simp /// A set of custom visitors which generate "event" diagnostics at 107279377Simp /// interesting points in the path. 108279377Simp VisitorList Callbacks; 109279377Simp 110279377Simp /// Used for ensuring the visitors are only added once. 111279377Simp llvm::FoldingSet<BugReporterVisitor> CallbacksSet; 112279377Simp 113279377Simp /// Used for clients to tell if the report's configuration has changed 114279377Simp /// since the last time they checked. 115279377Simp unsigned ConfigurationChangeToken; 116279377Simp 117279377Simp /// When set, this flag disables all callstack pruning from a diagnostic 118279377Simp /// path. This is useful for some reports that want maximum fidelty 119279377Simp /// when reporting an issue. 120279377Simp bool DoNotPrunePath; 121279377Simp 122279377Simp /// Used to track unique reasons why a bug report might be invalid. 123279377Simp /// 124279377Simp /// \sa markInvalid 125279377Simp /// \sa removeInvalidation 126279377Simp typedef std::pair<const void *, const void *> InvalidationRecord; 127279377Simp 128279377Simp /// If non-empty, this bug report is likely a false positive and should not be 129279377Simp /// shown to the user. 130279377Simp /// 131279377Simp /// \sa markInvalid 132279377Simp /// \sa removeInvalidation 133279377Simp llvm::SmallSet<InvalidationRecord, 4> Invalidations; 134279377Simp 135279377Simpprivate: 136279377Simp // Used internally by BugReporter. 137279377Simp Symbols &getInterestingSymbols(); 138279377Simp Regions &getInterestingRegions(); 139279377Simp 140279377Simp void lazyInitializeInterestingSets(); 141279377Simp void pushInterestingSymbolsAndRegions(); 142279377Simp void popInterestingSymbolsAndRegions(); 143279377Simp 144279377Simppublic: 145279377Simp BugReport(BugType& bt, StringRef desc, const ExplodedNode *errornode) 146279377Simp : BT(bt), DeclWithIssue(0), Description(desc), ErrorNode(errornode), 147279377Simp ConfigurationChangeToken(0), DoNotPrunePath(false) {} 148279377Simp 149279377Simp BugReport(BugType& bt, StringRef shortDesc, StringRef desc, 150279377Simp const ExplodedNode *errornode) 151279377Simp : BT(bt), DeclWithIssue(0), ShortDescription(shortDesc), Description(desc), 152279377Simp ErrorNode(errornode), ConfigurationChangeToken(0), 153279377Simp DoNotPrunePath(false) {} 154279377Simp 155279377Simp BugReport(BugType& bt, StringRef desc, PathDiagnosticLocation l) 156279377Simp : BT(bt), DeclWithIssue(0), Description(desc), Location(l), ErrorNode(0), 157279377Simp ConfigurationChangeToken(0), 158279377Simp DoNotPrunePath(false) {} 159279377Simp 160279377Simp /// \brief Create a BugReport with a custom uniqueing location. 161279377Simp /// 162279377Simp /// The reports that have the same report location, description, bug type, and 163279377Simp /// ranges are uniqued - only one of the equivalent reports will be presented 164279377Simp /// to the user. This method allows to rest the location which should be used 165279377Simp /// for uniquing reports. For example, memory leaks checker, could set this to 166279377Simp /// the allocation site, rather then the location where the bug is reported. 167279377Simp BugReport(BugType& bt, StringRef desc, const ExplodedNode *errornode, 168279377Simp PathDiagnosticLocation LocationToUnique, const Decl *DeclToUnique) 169279377Simp : BT(bt), DeclWithIssue(0), Description(desc), 170279377Simp UniqueingLocation(LocationToUnique), 171279377Simp UniqueingDecl(DeclToUnique), 172279377Simp ErrorNode(errornode), ConfigurationChangeToken(0), 173279377Simp DoNotPrunePath(false) {} 174279377Simp 175279377Simp virtual ~BugReport(); 176279377Simp 177279377Simp const BugType& getBugType() const { return BT; } 178279377Simp BugType& getBugType() { return BT; } 179279377Simp 180279377Simp const ExplodedNode *getErrorNode() const { return ErrorNode; } 181279377Simp 182279377Simp const StringRef getDescription() const { return Description; } 183279377Simp 184279377Simp const StringRef getShortDescription(bool UseFallback = true) const { 185279377Simp if (ShortDescription.empty() && UseFallback) 186279377Simp return Description; 187279377Simp return ShortDescription; 188279377Simp } 189279377Simp 190279377Simp /// Indicates whether or not any path pruning should take place 191279377Simp /// when generating a PathDiagnostic from this BugReport. 192279377Simp bool shouldPrunePath() const { return !DoNotPrunePath; } 193279377Simp 194279377Simp /// Disable all path pruning when generating a PathDiagnostic. 195279377Simp void disablePathPruning() { DoNotPrunePath = true; } 196279377Simp 197279377Simp void markInteresting(SymbolRef sym); 198279377Simp void markInteresting(const MemRegion *R); 199279377Simp void markInteresting(SVal V); 200279377Simp void markInteresting(const LocationContext *LC); 201279377Simp 202279377Simp bool isInteresting(SymbolRef sym); 203279377Simp bool isInteresting(const MemRegion *R); 204279377Simp bool isInteresting(SVal V); 205279377Simp bool isInteresting(const LocationContext *LC); 206279377Simp 207279377Simp unsigned getConfigurationChangeToken() const { 208279377Simp return ConfigurationChangeToken; 209279377Simp } 210279377Simp 211279377Simp /// Returns whether or not this report should be considered valid. 212279377Simp /// 213279377Simp /// Invalid reports are those that have been classified as likely false 214279377Simp /// positives after the fact. 215279377Simp bool isValid() const { 216279377Simp return Invalidations.empty(); 217279377Simp } 218279377Simp 219279377Simp /// Marks the current report as invalid, meaning that it is probably a false 220279377Simp /// positive and should not be reported to the user. 221279377Simp /// 222279377Simp /// The \p Tag and \p Data arguments are intended to be opaque identifiers for 223279377Simp /// this particular invalidation, where \p Tag represents the visitor 224279377Simp /// responsible for invalidation, and \p Data represents the reason this 225279377Simp /// visitor decided to invalidate the bug report. 226279377Simp /// 227279377Simp /// \sa removeInvalidation 228279377Simp void markInvalid(const void *Tag, const void *Data) { 229279377Simp Invalidations.insert(std::make_pair(Tag, Data)); 230279377Simp } 231279377Simp 232279377Simp /// Reverses the effects of a previous invalidation. 233279377Simp /// 234279377Simp /// \sa markInvalid 235279377Simp void removeInvalidation(const void *Tag, const void *Data) { 236279377Simp Invalidations.erase(std::make_pair(Tag, Data)); 237279377Simp } 238279377Simp 239279377Simp /// Return the canonical declaration, be it a method or class, where 240279377Simp /// this issue semantically occurred. 241279377Simp const Decl *getDeclWithIssue() const; 242279377Simp 243279377Simp /// Specifically set the Decl where an issue occurred. This isn't necessary 244279377Simp /// for BugReports that cover a path as it will be automatically inferred. 245279377Simp void setDeclWithIssue(const Decl *declWithIssue) { 246279377Simp DeclWithIssue = declWithIssue; 247279377Simp } 248279377Simp 249279377Simp /// \brief This allows for addition of meta data to the diagnostic. 250279377Simp /// 251279377Simp /// Currently, only the HTMLDiagnosticClient knows how to display it. 252279377Simp void addExtraText(StringRef S) { 253279377Simp ExtraText.push_back(S); 254279377Simp } 255279377Simp 256279377Simp virtual const ExtraTextList &getExtraText() { 257279377Simp return ExtraText; 258279377Simp } 259279377Simp 260279377Simp /// \brief Return the "definitive" location of the reported bug. 261279377Simp /// 262279377Simp /// While a bug can span an entire path, usually there is a specific 263279377Simp /// location that can be used to identify where the key issue occurred. 264279377Simp /// This location is used by clients rendering diagnostics. 265279377Simp virtual PathDiagnosticLocation getLocation(const SourceManager &SM) const; 266279377Simp 267279377Simp /// \brief Get the location on which the report should be uniqued. 268279377Simp PathDiagnosticLocation getUniqueingLocation() const { 269279377Simp return UniqueingLocation; 270279377Simp } 271279377Simp 272279377Simp /// \brief Get the declaration containing the uniqueing location. 273279377Simp const Decl *getUniqueingDecl() const { 274279377Simp return UniqueingDecl; 275279377Simp } 276279377Simp 277279377Simp const Stmt *getStmt() const; 278279377Simp 279279377Simp /// \brief Add a range to a bug report. 280279377Simp /// 281279377Simp /// Ranges are used to highlight regions of interest in the source code. 282279377Simp /// They should be at the same source code line as the BugReport location. 283279377Simp /// By default, the source range of the statement corresponding to the error 284279377Simp /// node will be used; add a single invalid range to specify absence of 285279377Simp /// ranges. 286279377Simp void addRange(SourceRange R) { 287279377Simp assert((R.isValid() || Ranges.empty()) && "Invalid range can only be used " 288279377Simp "to specify that the report does not have a range."); 289279377Simp Ranges.push_back(R); 290279377Simp } 291279377Simp 292279377Simp /// \brief Get the SourceRanges associated with the report. 293279377Simp virtual std::pair<ranges_iterator, ranges_iterator> getRanges(); 294279377Simp 295279377Simp /// \brief Add custom or predefined bug report visitors to this report. 296279377Simp /// 297279377Simp /// The visitors should be used when the default trace is not sufficient. 298279377Simp /// For example, they allow constructing a more elaborate trace. 299279377Simp /// \sa registerConditionVisitor(), registerTrackNullOrUndefValue(), 300279377Simp /// registerFindLastStore(), registerNilReceiverVisitor(), and 301279377Simp /// registerVarDeclsLastStore(). 302279377Simp void addVisitor(BugReporterVisitor *visitor); 303279377Simp 304279377Simp /// Iterators through the custom diagnostic visitors. 305279377Simp visitor_iterator visitor_begin() { return Callbacks.begin(); } 306279377Simp visitor_iterator visitor_end() { return Callbacks.end(); } 307279377Simp 308279377Simp /// Profile to identify equivalent bug reports for error report coalescing. 309279377Simp /// Reports are uniqued to ensure that we do not emit multiple diagnostics 310279377Simp /// for each bug. 311279377Simp virtual void Profile(llvm::FoldingSetNodeID& hash) const; 312279377Simp}; 313279377Simp 314279377Simp} // end ento namespace 315279377Simp} // end clang namespace 316279377Simp 317279377Simpnamespace llvm { 318279377Simp template<> struct ilist_traits<clang::ento::BugReport> 319279377Simp : public ilist_default_traits<clang::ento::BugReport> { 320279377Simp clang::ento::BugReport *createSentinel() const { 321279377Simp return static_cast<clang::ento::BugReport *>(&Sentinel); 322279377Simp } 323279377Simp void destroySentinel(clang::ento::BugReport *) const {} 324279377Simp 325279377Simp clang::ento::BugReport *provideInitialHead() const { 326279377Simp return createSentinel(); 327 } 328 clang::ento::BugReport *ensureHead(clang::ento::BugReport *) const { 329 return createSentinel(); 330 } 331 private: 332 mutable ilist_half_node<clang::ento::BugReport> Sentinel; 333 }; 334} 335 336namespace clang { 337namespace ento { 338 339//===----------------------------------------------------------------------===// 340// BugTypes (collections of related reports). 341//===----------------------------------------------------------------------===// 342 343class BugReportEquivClass : public llvm::FoldingSetNode { 344 /// List of *owned* BugReport objects. 345 llvm::ilist<BugReport> Reports; 346 347 friend class BugReporter; 348 void AddReport(BugReport* R) { Reports.push_back(R); } 349public: 350 BugReportEquivClass(BugReport* R) { Reports.push_back(R); } 351 ~BugReportEquivClass(); 352 353 void Profile(llvm::FoldingSetNodeID& ID) const { 354 assert(!Reports.empty()); 355 Reports.front().Profile(ID); 356 } 357 358 typedef llvm::ilist<BugReport>::iterator iterator; 359 typedef llvm::ilist<BugReport>::const_iterator const_iterator; 360 361 iterator begin() { return Reports.begin(); } 362 iterator end() { return Reports.end(); } 363 364 const_iterator begin() const { return Reports.begin(); } 365 const_iterator end() const { return Reports.end(); } 366}; 367 368//===----------------------------------------------------------------------===// 369// BugReporter and friends. 370//===----------------------------------------------------------------------===// 371 372class BugReporterData { 373public: 374 virtual ~BugReporterData(); 375 virtual DiagnosticsEngine& getDiagnostic() = 0; 376 virtual ArrayRef<PathDiagnosticConsumer*> getPathDiagnosticConsumers() = 0; 377 virtual ASTContext &getASTContext() = 0; 378 virtual SourceManager& getSourceManager() = 0; 379 virtual AnalyzerOptions& getAnalyzerOptions() = 0; 380}; 381 382/// BugReporter is a utility class for generating PathDiagnostics for analysis. 383/// It collects the BugReports and BugTypes and knows how to generate 384/// and flush the corresponding diagnostics. 385class BugReporter { 386public: 387 enum Kind { BaseBRKind, GRBugReporterKind }; 388 389private: 390 typedef llvm::ImmutableSet<BugType*> BugTypesTy; 391 BugTypesTy::Factory F; 392 BugTypesTy BugTypes; 393 394 const Kind kind; 395 BugReporterData& D; 396 397 /// Generate and flush the diagnostics for the given bug report. 398 void FlushReport(BugReportEquivClass& EQ); 399 400 /// Generate and flush the diagnostics for the given bug report 401 /// and PathDiagnosticConsumer. 402 void FlushReport(BugReport *exampleReport, 403 PathDiagnosticConsumer &PD, 404 ArrayRef<BugReport*> BugReports); 405 406 /// The set of bug reports tracked by the BugReporter. 407 llvm::FoldingSet<BugReportEquivClass> EQClasses; 408 /// A vector of BugReports for tracking the allocated pointers and cleanup. 409 std::vector<BugReportEquivClass *> EQClassesVector; 410 411protected: 412 BugReporter(BugReporterData& d, Kind k) : BugTypes(F.getEmptySet()), kind(k), 413 D(d) {} 414 415public: 416 BugReporter(BugReporterData& d) : BugTypes(F.getEmptySet()), kind(BaseBRKind), 417 D(d) {} 418 virtual ~BugReporter(); 419 420 /// \brief Generate and flush diagnostics for all bug reports. 421 void FlushReports(); 422 423 Kind getKind() const { return kind; } 424 425 DiagnosticsEngine& getDiagnostic() { 426 return D.getDiagnostic(); 427 } 428 429 ArrayRef<PathDiagnosticConsumer*> getPathDiagnosticConsumers() { 430 return D.getPathDiagnosticConsumers(); 431 } 432 433 /// \brief Iterator over the set of BugTypes tracked by the BugReporter. 434 typedef BugTypesTy::iterator iterator; 435 iterator begin() { return BugTypes.begin(); } 436 iterator end() { return BugTypes.end(); } 437 438 /// \brief Iterator over the set of BugReports tracked by the BugReporter. 439 typedef llvm::FoldingSet<BugReportEquivClass>::iterator EQClasses_iterator; 440 EQClasses_iterator EQClasses_begin() { return EQClasses.begin(); } 441 EQClasses_iterator EQClasses_end() { return EQClasses.end(); } 442 443 ASTContext &getContext() { return D.getASTContext(); } 444 445 SourceManager& getSourceManager() { return D.getSourceManager(); } 446 447 AnalyzerOptions& getAnalyzerOptions() { return D.getAnalyzerOptions(); } 448 449 virtual bool generatePathDiagnostic(PathDiagnostic& pathDiagnostic, 450 PathDiagnosticConsumer &PC, 451 ArrayRef<BugReport *> &bugReports) { 452 return true; 453 } 454 455 bool RemoveUnneededCalls(PathPieces &pieces, BugReport *R); 456 457 void Register(BugType *BT); 458 459 /// \brief Add the given report to the set of reports tracked by BugReporter. 460 /// 461 /// The reports are usually generated by the checkers. Further, they are 462 /// folded based on the profile value, which is done to coalesce similar 463 /// reports. 464 void emitReport(BugReport *R); 465 466 void EmitBasicReport(const Decl *DeclWithIssue, 467 StringRef BugName, StringRef BugCategory, 468 StringRef BugStr, PathDiagnosticLocation Loc, 469 ArrayRef<SourceRange> Ranges = None); 470 471private: 472 llvm::StringMap<BugType *> StrBugTypes; 473 474 /// \brief Returns a BugType that is associated with the given name and 475 /// category. 476 BugType *getBugTypeForName(StringRef name, StringRef category); 477}; 478 479// FIXME: Get rid of GRBugReporter. It's the wrong abstraction. 480class GRBugReporter : public BugReporter { 481 ExprEngine& Eng; 482public: 483 GRBugReporter(BugReporterData& d, ExprEngine& eng) 484 : BugReporter(d, GRBugReporterKind), Eng(eng) {} 485 486 virtual ~GRBugReporter(); 487 488 /// getEngine - Return the analysis engine used to analyze a given 489 /// function or method. 490 ExprEngine &getEngine() { return Eng; } 491 492 /// getGraph - Get the exploded graph created by the analysis engine 493 /// for the analyzed method or function. 494 ExplodedGraph &getGraph(); 495 496 /// getStateManager - Return the state manager used by the analysis 497 /// engine. 498 ProgramStateManager &getStateManager(); 499 500 /// Generates a path corresponding to one of the given bug reports. 501 /// 502 /// Which report is used for path generation is not specified. The 503 /// bug reporter will try to pick the shortest path, but this is not 504 /// guaranteed. 505 /// 506 /// \return True if the report was valid and a path was generated, 507 /// false if the reports should be considered invalid. 508 virtual bool generatePathDiagnostic(PathDiagnostic &PD, 509 PathDiagnosticConsumer &PC, 510 ArrayRef<BugReport*> &bugReports); 511 512 /// classof - Used by isa<>, cast<>, and dyn_cast<>. 513 static bool classof(const BugReporter* R) { 514 return R->getKind() == GRBugReporterKind; 515 } 516}; 517 518class BugReporterContext { 519 virtual void anchor(); 520 GRBugReporter &BR; 521public: 522 BugReporterContext(GRBugReporter& br) : BR(br) {} 523 524 virtual ~BugReporterContext() {} 525 526 GRBugReporter& getBugReporter() { return BR; } 527 528 ExplodedGraph &getGraph() { return BR.getGraph(); } 529 530 ProgramStateManager& getStateManager() { 531 return BR.getStateManager(); 532 } 533 534 SValBuilder& getSValBuilder() { 535 return getStateManager().getSValBuilder(); 536 } 537 538 ASTContext &getASTContext() { 539 return BR.getContext(); 540 } 541 542 SourceManager& getSourceManager() { 543 return BR.getSourceManager(); 544 } 545 546 virtual BugReport::NodeResolver& getNodeResolver() = 0; 547}; 548 549} // end GR namespace 550 551} // end clang namespace 552 553#endif 554