Remove Checker::CheckType() (and instead using CheckerVisitor::PreVisitDeclStmt()), and refactor VLASizeChecker to have only one Checker subclass (not two) and to not use the node builders directly (and instead use the newer CheckerContext).

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@86329 91177308-0d34-0410-b5e6-96231b3b80d8

1 files changed, 65 insertions, 99 deletions

diff --git a/lib/Analysis/VLASizeChecker.cpp b/lib/Analysis/VLASizeChecker.cpp
index 49e19434cb..98b755be53 100644
--- a/lib/Analysis/VLASizeChecker.cpp
+++ b/lib/Analysis/VLASizeChecker.cpp
@@ -7,124 +7,90 @@
 //
 //===----------------------------------------------------------------------===//
 //
-// This defines two VLASizeCheckers, a builtin check in GRExprEngine that 
+// This defines VLASizeChecker, a builtin check in GRExprEngine that 
 // performs checks for declaration of VLA of undefined or zero size.
 //
 //===----------------------------------------------------------------------===//
 
 #include "GRExprEngineInternalChecks.h"
-#include "clang/Analysis/PathSensitive/Checker.h"
+#include "clang/Analysis/PathSensitive/CheckerVisitor.h"
 #include "clang/Analysis/PathSensitive/GRExprEngine.h"
 #include "clang/Analysis/PathSensitive/BugReporter.h"
 
 using namespace clang;
 
 namespace {
-class VISIBILITY_HIDDEN UndefSizedVLAChecker : public Checker {
-  BugType *BT;
+class VISIBILITY_HIDDEN VLASizeChecker : public CheckerVisitor<VLASizeChecker> {
+  BugType *BT_zero;
+  BugType *BT_undef;
   
 public:
-  UndefSizedVLAChecker() : BT(0) {}
-  static void *getTag();
-  ExplodedNode *CheckType(QualType T, ExplodedNode *Pred, 
-                          const GRState *state, Stmt *S, GRExprEngine &Eng);
-};
-
-class VISIBILITY_HIDDEN ZeroSizedVLAChecker : public Checker {
-  BugType *BT;
-  
-public:
-  ZeroSizedVLAChecker() : BT(0) {}
-  static void *getTag();
-  ExplodedNode *CheckType(QualType T, ExplodedNode *Pred, 
-                          const GRState *state, Stmt *S, GRExprEngine &Eng);
+  VLASizeChecker() : BT_zero(0), BT_undef(0) {}
+  static void *getTag() { static int tag = 0; return &tag; }
+  void PreVisitDeclStmt(CheckerContext &C, const DeclStmt *DS);
 };
 } // end anonymous namespace
 
 void clang::RegisterVLASizeChecker(GRExprEngine &Eng) {
-  Eng.registerCheck(new UndefSizedVLAChecker());
-  Eng.registerCheck(new ZeroSizedVLAChecker());
-}
-
-void *UndefSizedVLAChecker::getTag() {
-  static int x = 0;
-  return &x;
+  Eng.registerCheck(new VLASizeChecker());
 }
 
-ExplodedNode *UndefSizedVLAChecker::CheckType(QualType T, ExplodedNode *Pred,
-                                              const GRState *state,
-                                              Stmt *S, GRExprEngine &Eng) {
-  GRStmtNodeBuilder &Builder = Eng.getBuilder();
-  BugReporter &BR = Eng.getBugReporter();
-
-  if (VariableArrayType* VLA = dyn_cast<VariableArrayType>(T)) {
-    // FIXME: Handle multi-dimensional VLAs.
-    Expr* SE = VLA->getSizeExpr();
-    SVal Size_untested = state->getSVal(SE);
-
-    if (Size_untested.isUndef()) {
-      if (ExplodedNode* N = Builder.generateNode(S, state, Pred)) {
-        N->markAsSink();
-        if (!BT)
-          BT = new BuiltinBug("Declared variable-length array (VLA) uses a "
-                              "garbage value as its size");
-
-        EnhancedBugReport *R =
-                          new EnhancedBugReport(*BT, BT->getName().c_str(), N);
-        R->addRange(SE->getSourceRange());
-        R->addVisitorCreator(bugreporter::registerTrackNullOrUndefValue, SE);
-        BR.EmitReport(R);
-      }
-      return 0;    
-    }
+void VLASizeChecker::PreVisitDeclStmt(CheckerContext &C, const DeclStmt *DS) {
+  if (!DS->isSingleDecl())
+    return;
+  
+  const VarDecl *VD = dyn_cast<VarDecl>(DS->getSingleDecl());
+  if (!VD)
+    return;
+  
+  const VariableArrayType *VLA = VD->getType()->getAs<VariableArrayType>();
+  if (!VLA)
+    return;
+
+  // FIXME: Handle multi-dimensional VLAs.
+  const Expr* SE = VLA->getSizeExpr();
+  const GRState *state = C.getState();
+  SVal sizeV = state->getSVal(SE);
+
+  if (sizeV.isUndef()) {
+    // Generate an error node.
+    ExplodedNode *N = C.GenerateNode(DS, true);    
+    if (!N)
+      return;
+    
+    if (!BT_undef)
+      BT_undef = new BuiltinBug("Declared variable-length array (VLA) uses a "
+                                "garbage value as its size");
+
+    EnhancedBugReport *report =
+      new EnhancedBugReport(*BT_undef, BT_undef->getName().c_str(), N);
+    report->addRange(SE->getSourceRange());
+    report->addVisitorCreator(bugreporter::registerTrackNullOrUndefValue, SE);
+    C.EmitReport(report);
+    return;
   }
-  return Pred;
-}
-
-void *ZeroSizedVLAChecker::getTag() {
-  static int x;
-  return &x;
-}
-
-ExplodedNode *ZeroSizedVLAChecker::CheckType(QualType T, ExplodedNode *Pred, 
-                                             const GRState *state, Stmt *S, 
-                                             GRExprEngine &Eng) {
-  GRStmtNodeBuilder &Builder = Eng.getBuilder();
-  BugReporter &BR = Eng.getBugReporter();
-
-  if (VariableArrayType* VLA = dyn_cast<VariableArrayType>(T)) {
-    // FIXME: Handle multi-dimensional VLAs.
-    Expr* SE = VLA->getSizeExpr();
-    SVal Size_untested = state->getSVal(SE);
-
-    DefinedOrUnknownSVal *Size = dyn_cast<DefinedOrUnknownSVal>(&Size_untested);
-    // Undefined size is checked in another checker.
-    if (!Size)
-      return Pred;
-
-    const GRState *zeroState =  state->Assume(*Size, false);
-    state = state->Assume(*Size, true);
-
-    if (zeroState && !state) {
-      if (ExplodedNode* N = Builder.generateNode(S, zeroState, Pred)) {
-        N->markAsSink();
-        if (!BT)
-          BT = new BugType("Declared variable-length array (VLA) has zero size",
-                            "Logic error");
-
-        EnhancedBugReport *R =
-                          new EnhancedBugReport(*BT, BT->getName().c_str(), N);
-        R->addRange(SE->getSourceRange());
-        R->addVisitorCreator(bugreporter::registerTrackNullOrUndefValue, SE);
-        BR.EmitReport(R);
-      }
-    }
-    if (!state)
-      return 0;
-
-    return Builder.generateNode(S, state, Pred);
+  
+  // Check if the size is zero.
+  DefinedOrUnknownSVal sizeD = cast<DefinedOrUnknownSVal>(sizeV);
+
+  const GRState *stateNotZero, *stateZero;
+  llvm::tie(stateNotZero, stateZero) = state->Assume(sizeD);
+
+  if (stateZero && !stateNotZero) {
+    ExplodedNode* N = C.GenerateNode(DS, stateZero, true);
+    if (!BT_zero)
+      BT_zero = new BuiltinBug("Declared variable-length array (VLA) has zero "
+                               "size");
+
+    EnhancedBugReport *report =
+      new EnhancedBugReport(*BT_zero, BT_zero->getName().c_str(), N);
+    report->addRange(SE->getSourceRange());
+    report->addVisitorCreator(bugreporter::registerTrackNullOrUndefValue, SE);
+    C.EmitReport(report);
+    return;
   }
-  else
-    return Pred;
+ 
+  // From this point on, assume that the size is not zero.
+  if (state != stateNotZero)
+    C.addTransition(C.GenerateNode(DS, stateNotZero));  
 }
-