diff options
28 files changed, 131 insertions, 114 deletions
diff --git a/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h b/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h index 4725e395ce..15fd52b558 100644 --- a/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h +++ b/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h @@ -87,36 +87,50 @@ public: return Eng.getStateManager(); } - AnalysisDeclContext *getCurrentAnalysisDeclContext() const { return Pred->getLocationContext()->getAnalysisDeclContext(); } - /// \brief Generate a default checker node (containing checker tag but no - /// checker state changes). - ExplodedNode *generateNode() { - return generateNode(getState()); + /// \brief Generates a new transition in the program state graph + /// (ExplodedGraph). Uses the default CheckerContext predecessor node. + /// + /// @param State The state of the generated node. + /// @param Tag The tag is used to uniquely identify the creation site. If no + /// tag is specified, a default tag, unique to the given checker, + /// will be used. Tags are used to prevent states generated at + /// different sites from caching out. + ExplodedNode *addTransition(const ProgramState *State, + const ProgramPointTag *Tag = 0) { + return addTransitionImpl(State, false, 0, Tag); } - - /// \brief Generate a new checker node. - ExplodedNode *generateNode(const ProgramState *state, - const ProgramPointTag *tag = 0) { - return generateNodeImpl(state, false, 0, tag); + + /// \brief Generates a default transition (containing checker tag but no + /// checker state changes). + // TODO: Can we remove this one? We always generate autotransitions. + ExplodedNode *addTransition() { + return addTransition(getState()); } - /// \brief Generate a new checker node with the given predecessor. + /// \brief Generates a new transition with the given predecessor. /// Allows checkers to generate a chain of nodes. - ExplodedNode *generateNode(const ProgramState *state, - ExplodedNode *pred, - const ProgramPointTag *tag = 0, - bool isSink = false) { - return generateNodeImpl(state, isSink, pred, tag); + /// + /// @param State The state of the generated node. + /// @param Pred The transition will be generated from the specified Pred node + /// to the newly generated node. + /// @param Tag The tag to uniquely identify the creation site. + /// @param IsSink Mark the new node as sink, which will stop exploration of + /// the given path. + ExplodedNode *addTransition(const ProgramState *State, + ExplodedNode *Pred, + const ProgramPointTag *Tag = 0, + bool IsSink = false) { + return addTransitionImpl(State, IsSink, Pred, Tag); } /// \brief Generate a sink node. Generating sink stops exploration of the /// given path. ExplodedNode *generateSink(const ProgramState *state = 0) { - return generateNodeImpl(state ? state : getState(), true); + return addTransitionImpl(state ? state : getState(), true); } /// \brief Emit the diagnostics report. @@ -124,6 +138,9 @@ public: Eng.getBugReporter().EmitReport(R); } + /// \brief Emit a very simple diagnostic report. Should only be used for + /// non-path sensitive checkers. + // TODO: We should not need it here! void EmitBasicReport(StringRef Name, StringRef Category, StringRef Str, PathDiagnosticLocation Loc, @@ -133,7 +150,7 @@ public: } private: - ExplodedNode *generateNodeImpl(const ProgramState *state, + ExplodedNode *addTransitionImpl(const ProgramState *state, bool markAsSink, ExplodedNode *pred = 0, const ProgramPointTag *tag = 0) { diff --git a/lib/StaticAnalyzer/Checkers/AdjustedReturnValueChecker.cpp b/lib/StaticAnalyzer/Checkers/AdjustedReturnValueChecker.cpp index dc524ba24e..7dad2421bf 100644 --- a/lib/StaticAnalyzer/Checkers/AdjustedReturnValueChecker.cpp +++ b/lib/StaticAnalyzer/Checkers/AdjustedReturnValueChecker.cpp @@ -46,7 +46,7 @@ void AdjustedReturnValueChecker::checkPostStmt(const CallExpr *CE, // Casting to void? Discard the value. if (expectedResultTy->isVoidType()) { - C.generateNode(state->BindExpr(CE, UnknownVal())); + C.addTransition(state->BindExpr(CE, UnknownVal())); return; } @@ -82,7 +82,7 @@ void AdjustedReturnValueChecker::checkPostStmt(const CallExpr *CE, // the cast avoids some assertion failures elsewhere. SValBuilder &svalBuilder = C.getSValBuilder(); V = svalBuilder.evalCast(V, expectedResultTy, actualResultTy); - C.generateNode(state->BindExpr(CE, V)); + C.addTransition(state->BindExpr(CE, V)); } } diff --git a/lib/StaticAnalyzer/Checkers/ArrayBoundChecker.cpp b/lib/StaticAnalyzer/Checkers/ArrayBoundChecker.cpp index f8cd335258..a1a34f6dcc 100644 --- a/lib/StaticAnalyzer/Checkers/ArrayBoundChecker.cpp +++ b/lib/StaticAnalyzer/Checkers/ArrayBoundChecker.cpp @@ -84,7 +84,7 @@ void ArrayBoundChecker::checkLocation(SVal l, bool isLoad, const Stmt* LoadS, // Array bound check succeeded. From this point forward the array bound // should always succeed. - C.generateNode(StInBound); + C.addTransition(StInBound); } void ento::registerArrayBoundChecker(CheckerManager &mgr) { diff --git a/lib/StaticAnalyzer/Checkers/ArrayBoundCheckerV2.cpp b/lib/StaticAnalyzer/Checkers/ArrayBoundCheckerV2.cpp index 6175028a9b..59733564fb 100644 --- a/lib/StaticAnalyzer/Checkers/ArrayBoundCheckerV2.cpp +++ b/lib/StaticAnalyzer/Checkers/ArrayBoundCheckerV2.cpp @@ -166,7 +166,7 @@ void ArrayBoundCheckerV2::checkLocation(SVal location, bool isLoad, while (false); if (state != originalState) - checkerContext.generateNode(state); + checkerContext.addTransition(state); } void ArrayBoundCheckerV2::reportOOB(CheckerContext &checkerContext, diff --git a/lib/StaticAnalyzer/Checkers/AttrNonNullChecker.cpp b/lib/StaticAnalyzer/Checkers/AttrNonNullChecker.cpp index fa96d62ce3..8296eb93c5 100644 --- a/lib/StaticAnalyzer/Checkers/AttrNonNullChecker.cpp +++ b/lib/StaticAnalyzer/Checkers/AttrNonNullChecker.cpp @@ -125,7 +125,7 @@ void AttrNonNullChecker::checkPreStmt(const CallExpr *CE, // If we reach here all of the arguments passed the nonnull check. // If 'state' has been updated generated a new node. - C.generateNode(state); + C.addTransition(state); } void ento::registerAttrNonNullChecker(CheckerManager &mgr) { diff --git a/lib/StaticAnalyzer/Checkers/BasicObjCFoundationChecks.cpp b/lib/StaticAnalyzer/Checkers/BasicObjCFoundationChecks.cpp index 0d68db3c8a..bc6e8f303f 100644 --- a/lib/StaticAnalyzer/Checkers/BasicObjCFoundationChecks.cpp +++ b/lib/StaticAnalyzer/Checkers/BasicObjCFoundationChecks.cpp @@ -316,7 +316,7 @@ void CFNumberCreateChecker::checkPreStmt(const CallExpr *CE, // the bits initialized to the provided values. // if (ExplodedNode *N = SourceSize < TargetSize ? C.generateSink() - : C.generateNode()) { + : C.addTransition()) { llvm::SmallString<128> sbuf; llvm::raw_svector_ostream os(sbuf); @@ -421,7 +421,7 @@ void CFRetainReleaseChecker::checkPreStmt(const CallExpr *CE, } // From here on, we know the argument is non-null. - C.generateNode(stateFalse); + C.addTransition(stateFalse); } //===----------------------------------------------------------------------===// @@ -464,7 +464,7 @@ void ClassReleaseChecker::checkPreObjCMessage(ObjCMessage msg, if (!(S == releaseS || S == retainS || S == autoreleaseS || S == drainS)) return; - if (ExplodedNode *N = C.generateNode()) { + if (ExplodedNode *N = C.addTransition()) { llvm::SmallString<200> buf; llvm::raw_svector_ostream os(buf); @@ -612,7 +612,7 @@ void VariadicMethodTypeChecker::checkPreObjCMessage(ObjCMessage msg, // Generate only one error node to use for all bug reports. if (!errorNode.hasValue()) { - errorNode = C.generateNode(); + errorNode = C.addTransition(); } if (!errorNode.getValue()) diff --git a/lib/StaticAnalyzer/Checkers/BuiltinFunctionChecker.cpp b/lib/StaticAnalyzer/Checkers/BuiltinFunctionChecker.cpp index a57d03175c..d00ef590fb 100644 --- a/lib/StaticAnalyzer/Checkers/BuiltinFunctionChecker.cpp +++ b/lib/StaticAnalyzer/Checkers/BuiltinFunctionChecker.cpp @@ -49,7 +49,7 @@ bool BuiltinFunctionChecker::evalCall(const CallExpr *CE, // For __builtin_expect, just return the value of the subexpression. assert (CE->arg_begin() != CE->arg_end()); SVal X = state->getSVal(*(CE->arg_begin())); - C.generateNode(state->BindExpr(CE, X)); + C.addTransition(state->BindExpr(CE, X)); return true; } @@ -72,7 +72,7 @@ bool BuiltinFunctionChecker::evalCall(const CallExpr *CE, svalBuilder.evalEQ(state, Extent, Size); state = state->assume(extentMatchesSizeArg, true); - C.generateNode(state->BindExpr(CE, loc::MemRegionVal(R))); + C.addTransition(state->BindExpr(CE, loc::MemRegionVal(R))); return true; } } diff --git a/lib/StaticAnalyzer/Checkers/CStringChecker.cpp b/lib/StaticAnalyzer/Checkers/CStringChecker.cpp index 78c92ee8ea..1795b82fbb 100644 --- a/lib/StaticAnalyzer/Checkers/CStringChecker.cpp +++ b/lib/StaticAnalyzer/Checkers/CStringChecker.cpp @@ -659,7 +659,7 @@ SVal CStringChecker::getCStringLength(CheckerContext &C, const ProgramState *&st // C string. In the context of locations, the only time we can issue such // a warning is for labels. if (loc::GotoLabel *Label = dyn_cast<loc::GotoLabel>(&Buf)) { - if (ExplodedNode *N = C.generateNode(state)) { + if (ExplodedNode *N = C.addTransition(state)) { if (!BT_NotCString) BT_NotCString.reset(new BuiltinBug("API", "Argument is not a null-terminated string.")); @@ -716,7 +716,7 @@ SVal CStringChecker::getCStringLength(CheckerContext &C, const ProgramState *&st // Other regions (mostly non-data) can't have a reliable C string length. // In this case, an error is emitted and UndefinedVal is returned. // The caller should always be prepared to handle this case. - if (ExplodedNode *N = C.generateNode(state)) { + if (ExplodedNode *N = C.addTransition(state)) { if (!BT_NotCString) BT_NotCString.reset(new BuiltinBug("API", "Argument is not a null-terminated string.")); @@ -859,7 +859,7 @@ void CStringChecker::evalCopyCommon(CheckerContext &C, // just bind the return value to the destination buffer and return. if (stateZeroSize) { stateZeroSize = stateZeroSize->BindExpr(CE, destVal); - C.generateNode(stateZeroSize); + C.addTransition(stateZeroSize); } // If the size can be nonzero, we have to check the other arguments. @@ -931,7 +931,7 @@ void CStringChecker::evalCopyCommon(CheckerContext &C, // This would probably remove any existing bindings past the end of the // copied region, but that's still an improvement over blank invalidation. state = InvalidateBuffer(C, state, Dest, state->getSVal(Dest)); - C.generateNode(state); + C.addTransition(state); } } @@ -993,7 +993,7 @@ void CStringChecker::evalMemcmp(CheckerContext &C, const CallExpr *CE) const { if (stateZeroSize) { state = stateZeroSize; state = state->BindExpr(CE, svalBuilder.makeZeroVal(CE->getType())); - C.generateNode(state); + C.addTransition(state); } // If the size can be nonzero, we have to check the other arguments. @@ -1017,7 +1017,7 @@ void CStringChecker::evalMemcmp(CheckerContext &C, const CallExpr *CE) const { state = CheckBufferAccess(C, state, Size, Left); if (state) { state = StSameBuf->BindExpr(CE, svalBuilder.makeZeroVal(CE->getType())); - C.generateNode(state); + C.addTransition(state); } } @@ -1031,7 +1031,7 @@ void CStringChecker::evalMemcmp(CheckerContext &C, const CallExpr *CE) const { unsigned Count = C.getCurrentBlockCount(); SVal CmpV = svalBuilder.getConjuredSymbolVal(NULL, CE, Count); state = state->BindExpr(CE, CmpV); - C.generateNode(state); + C.addTransition(state); } } } @@ -1067,7 +1067,7 @@ void CStringChecker::evalstrLengthCommon(CheckerContext &C, const CallExpr *CE, if (stateZeroSize) { SVal zero = C.getSValBuilder().makeZeroVal(CE->getType()); stateZeroSize = stateZeroSize->BindExpr(CE, zero); - C.generateNode(stateZeroSize); + C.addTransition(stateZeroSize); } // If the size is GUARANTEED to be zero, we're done! @@ -1170,7 +1170,7 @@ void CStringChecker::evalstrLengthCommon(CheckerContext &C, const CallExpr *CE, // Bind the return value. assert(!result.isUnknown() && "Should have conjured a value by now"); state = state->BindExpr(CE, result); - C.generateNode(state); + C.addTransition(state); } void CStringChecker::evalStrcpy(CheckerContext &C, const CallExpr *CE) const { @@ -1512,7 +1512,7 @@ void CStringChecker::evalStrcpyCommon(CheckerContext &C, const CallExpr *CE, // Set the return value. state = state->BindExpr(CE, Result); - C.generateNode(state); + C.addTransition(state); } void CStringChecker::evalStrcmp(CheckerContext &C, const CallExpr *CE) const { @@ -1582,7 +1582,7 @@ void CStringChecker::evalStrcmpCommon(CheckerContext &C, const CallExpr *CE, // and we only need to check one size. if (StSameBuf) { StSameBuf = StSameBuf->BindExpr(CE, svalBuilder.makeZeroVal(CE->getType())); - C.generateNode(StSameBuf); + C.addTransition(StSameBuf); // If the two arguments are GUARANTEED to be the same, we're done! if (!StNotSameBuf) @@ -1656,7 +1656,7 @@ void CStringChecker::evalStrcmpCommon(CheckerContext &C, const CallExpr *CE, } // Record this as a possible path. - C.generateNode(state); + C.addTransition(state); } //===----------------------------------------------------------------------===// @@ -1746,7 +1746,7 @@ void CStringChecker::checkPreStmt(const DeclStmt *DS, CheckerContext &C) const { state = state->set<CStringLength>(MR, strLength); } - C.generateNode(state); + C.addTransition(state); } bool CStringChecker::wantsRegionChangeUpdate(const ProgramState *state) const { @@ -1842,7 +1842,7 @@ void CStringChecker::checkDeadSymbols(SymbolReaper &SR, } state = state->set<CStringLength>(Entries); - C.generateNode(state); + C.addTransition(state); } void ento::registerCStringChecker(CheckerManager &mgr) { diff --git a/lib/StaticAnalyzer/Checkers/CallAndMessageChecker.cpp b/lib/StaticAnalyzer/Checkers/CallAndMessageChecker.cpp index 112424256a..8a7f48b6f8 100644 --- a/lib/StaticAnalyzer/Checkers/CallAndMessageChecker.cpp +++ b/lib/StaticAnalyzer/Checkers/CallAndMessageChecker.cpp @@ -312,7 +312,7 @@ void CallAndMessageChecker::HandleNilReceiver(CheckerContext &C, // The result is not consumed by a surrounding expression. Just propagate // the current state. - C.generateNode(state); + C.addTransition(state); return; } @@ -349,11 +349,11 @@ void CallAndMessageChecker::HandleNilReceiver(CheckerContext &C, // of this case unless we have *a lot* more knowledge. // SVal V = C.getSValBuilder().makeZeroVal(msg.getType(Ctx)); - C.generateNode(state->BindExpr(msg.getOriginExpr(), V)); + C.addTransition(state->BindExpr(msg.getOriginExpr(), V)); return; } - C.generateNode(state); + C.addTransition(state); } void ento::registerCallAndMessageChecker(CheckerManager &mgr) { diff --git a/lib/StaticAnalyzer/Checkers/CastToStructChecker.cpp b/lib/StaticAnalyzer/Checkers/CastToStructChecker.cpp index c855210667..2a3da7800c 100644 --- a/lib/StaticAnalyzer/Checkers/CastToStructChecker.cpp +++ b/lib/StaticAnalyzer/Checkers/CastToStructChecker.cpp @@ -56,7 +56,7 @@ void CastToStructChecker::checkPreStmt(const CastExpr *CE, // Now the cast-to-type is struct pointer, the original type is not void*. if (!OrigPointeeTy->isRecordType()) { - if (ExplodedNode *N = C.generateNode()) { + if (ExplodedNode *N = C.addTransition()) { if (!BT) BT.reset(new BuiltinBug("Cast from non-struct type to struct type", "Casting a non-structure type to a structure type " diff --git a/lib/StaticAnalyzer/Checkers/ChrootChecker.cpp b/lib/StaticAnalyzer/Checkers/ChrootChecker.cpp index 769a93e161..2f3ff26de5 100644 --- a/lib/StaticAnalyzer/Checkers/ChrootChecker.cpp +++ b/lib/StaticAnalyzer/Checkers/ChrootChecker.cpp @@ -94,7 +94,7 @@ void ChrootChecker::Chroot(CheckerContext &C, const CallExpr *CE) const { // Once encouter a chroot(), set the enum value ROOT_CHANGED directly in // the GDM. state = Mgr.addGDM(state, ChrootChecker::getTag(), (void*) ROOT_CHANGED); - C.generateNode(state); + C.addTransition(state); } void ChrootChecker::Chdir(CheckerContext &C, const CallExpr *CE) const { @@ -120,7 +120,7 @@ void ChrootChecker::Chdir(CheckerContext &C, const CallExpr *CE) const { } } - C.generateNode(state); + C.addTransition(state); } // Check the jail state before any function call except chroot and chdir(). @@ -146,7 +146,7 @@ void ChrootChecker::checkPreStmt(const CallExpr *CE, CheckerContext &C) const { void *const* k = state->FindGDM(ChrootChecker::getTag()); if (k) if (isRootChanged((intptr_t) *k)) - if (ExplodedNode *N = C.generateNode()) { + if (ExplodedNode *N = C.addTransition()) { if (!BT_BreakJail) BT_BreakJail.reset(new BuiltinBug("Break out of jail", "No call of chdir(\"/\") immediately " diff --git a/lib/StaticAnalyzer/Checkers/DereferenceChecker.cpp b/lib/StaticAnalyzer/Checkers/DereferenceChecker.cpp index ab9631dd3f..eeda734a07 100644 --- a/lib/StaticAnalyzer/Checkers/DereferenceChecker.cpp +++ b/lib/StaticAnalyzer/Checkers/DereferenceChecker.cpp @@ -184,7 +184,7 @@ void DereferenceChecker::checkLocation(SVal l, bool isLoad, const Stmt* S, } // From this point forward, we know that the location is not null. - C.generateNode(notNullState); + C.addTransition(notNullState); } void ento::registerDereferenceChecker(CheckerManager &mgr) { diff --git a/lib/StaticAnalyzer/Checkers/DivZeroChecker.cpp b/lib/StaticAnalyzer/Checkers/DivZeroChecker.cpp index 3bae92b2ec..75b7cc47aa 100644 --- a/lib/StaticAnalyzer/Checkers/DivZeroChecker.cpp +++ b/lib/StaticAnalyzer/Checkers/DivZeroChecker.cpp @@ -73,7 +73,7 @@ void DivZeroChecker::checkPreStmt(const BinaryOperator *B, // If we get here, then the denom should not be zero. We abandon the implicit // zero denom case for now. - C.generateNode(stateNotZero); + C.addTransition(stateNotZero); } void ento::registerDivZeroChecker(CheckerManager &mgr) { diff --git a/lib/StaticAnalyzer/Checkers/FixedAddressChecker.cpp b/lib/StaticAnalyzer/Checkers/FixedAddressChecker.cpp index 531d87e426..7bdd4f34a7 100644 --- a/lib/StaticAnalyzer/Checkers/FixedAddressChecker.cpp +++ b/lib/StaticAnalyzer/Checkers/FixedAddressChecker.cpp @@ -51,7 +51,7 @@ void FixedAddressChecker::checkPreStmt(const BinaryOperator *B, if (!RV.isConstant() || RV.isZeroConstant()) return; - if (ExplodedNode *N = C.generateNode()) { + if (ExplodedNode *N = C.addTransition()) { if (!BT) BT.reset(new BuiltinBug("Use fixed address", "Using a fixed address is not portable because that " diff --git a/lib/StaticAnalyzer/Checkers/IteratorsChecker.cpp b/lib/StaticAnalyzer/Checkers/IteratorsChecker.cpp index d7496b1a6e..a064a65b10 100644 --- a/lib/StaticAnalyzer/Checkers/IteratorsChecker.cpp +++ b/lib/StaticAnalyzer/Checkers/IteratorsChecker.cpp @@ -405,7 +405,7 @@ void IteratorsChecker::checkExpr(CheckerContext &C, const Expr *E) const { if (!RS) return; if (RS->isInvalid()) { - if (ExplodedNode *N = C.generateNode()) { + if (ExplodedNode *N = C.addTransition()) { if (!BT_Invalid) // FIXME: We are eluding constness here. const_cast<IteratorsChecker*>(this)->BT_Invalid = new BuiltinBug(""); @@ -428,7 +428,7 @@ void IteratorsChecker::checkExpr(CheckerContext &C, const Expr *E) const { } } else if (RS->isUndefined()) { - if (ExplodedNode *N = C.generateNode()) { + if (ExplodedNode *N = C.addTransition()) { if (!BT_Undefined) // FIXME: We are eluding constness here. const_cast<IteratorsChecker*>(this)->BT_Undefined = @@ -472,7 +472,7 @@ void IteratorsChecker::checkPreStmt(const CXXOperatorCallExpr *OCE, if (Kind == OO_Equal) { checkExpr(C, OCE->getArg(1)); state = handleAssign(state, OCE->getArg(0), OCE->getArg(1), LC); - C.generateNode(state); + C.addTransition(state); return; } else { @@ -497,7 +497,7 @@ void IteratorsChecker::checkPreStmt(const CXXOperatorCallExpr *OCE, if (!RS1) return; if (RS0->getMemRegion() != RS1->getMemRegion()) { - if (ExplodedNode *N = C.generateNode()) { + if (ExplodedNode *N = C.addTransition()) { if (!BT_Incompatible) const_cast<IteratorsChecker*>(this)->BT_Incompatible = new BuiltinBug( @@ -550,7 +550,7 @@ void IteratorsChecker::checkPreStmt(const DeclStmt *DS, } } } - C.generateNode(state); + C.addTransition(state); } @@ -600,6 +600,6 @@ void IteratorsChecker::checkPreStmt(const CXXMemberCallExpr *MCE, state = state->add<CalledReserved>(MR); if (state != C.getState()) - C.generateNode(state); + C.addTransition(state); } diff --git a/lib/StaticAnalyzer/Checkers/MacOSKeychainAPIChecker.cpp b/lib/StaticAnalyzer/Checkers/MacOSKeychainAPIChecker.cpp index 29e119da4d..6dc51a4ace 100644 --- a/lib/StaticAnalyzer/Checkers/MacOSKeychainAPIChecker.cpp +++ b/lib/StaticAnalyzer/Checkers/MacOSKeychainAPIChecker.cpp @@ -261,7 +261,7 @@ void MacOSKeychainAPIChecker:: CheckerContext &C) const { const ProgramState *State = C.getState(); State = State->remove<AllocatedData>(AP.first); - ExplodedNode *N = C.generateNode(State); + ExplodedNode *N = C.addTransition(State); if (!N) return; @@ -304,7 +304,7 @@ void MacOSKeychainAPIChecker::checkPreStmt(const CallExpr *CE, // Remove the value from the state. The new symbol will be added for // tracking when the second allocator is processed in checkPostStmt(). State = State->remove<AllocatedData>(V); - ExplodedNode *N = C.generateNode(State); + ExplodedNode *N = C.addTransition(State); if (!N) return; initBugType(); @@ -362,7 +362,7 @@ void MacOSKeychainAPIChecker::checkPreStmt(const CallExpr *CE, if (isEnclosingFunctionParam(ArgExpr)) return; - ExplodedNode *N = C.generateNode(State); + ExplodedNode *N = C.addTransition(State); if (!N) return; initBugType(); @@ -400,7 +400,7 @@ void MacOSKeychainAPIChecker::checkPreStmt(const CallExpr *CE, // custom deallocator which does the right thing. if (DE->getFoundDecl()->getName() != "kCFAllocatorNull") { State = State->remove<AllocatedData>(ArgSM); - C.generateNode(State); + C.addTransition(State); return; } } @@ -422,7 +422,7 @@ void MacOSKeychainAPIChecker::checkPreStmt(const CallExpr *CE, // If the return status is undefined or is error, report a bad call to free. if (!definitelyDidnotReturnError(AS->Region, State, C.getSValBuilder())) { - ExplodedNode *N = C.generateNode(State); + ExplodedNode *N = C.addTransition(State); if (!N) return; initBugType(); @@ -434,7 +434,7 @@ void MacOSKeychainAPIChecker::checkPreStmt(const CallExpr *CE, return; } - C.generateNode(State); + C.addTransition(State); } void MacOSKeychainAPIChecker::checkPostStmt(const CallExpr *CE, @@ -482,7 +482,7 @@ void MacOSKeychainAPIChecker::checkPostStmt(const CallExpr *CE, State = State->set<AllocatedData>(V, AllocationState(ArgExpr, idx, RetStatusSymbol)); assert(State); - C.generateNode(State); + C.addTransition(State); } } @@ -500,7 +500,7 @@ void MacOSKeychainAPIChecker::checkPreStmt(const ReturnStmt *S, state = state->remove<AllocatedData>(getSymbolForRegion(C, V)); // Proceed from the new state. - C.generateNode(state); + C.addTransition(state); } BugReport *MacOSKeychainAPIChecker:: @@ -545,7 +545,7 @@ void MacOSKeychainAPIChecker::checkDeadSymbols(SymbolReaper &SR, return; // Generate the new, cleaned up state. - ExplodedNode *N = C.generateNode(State); + ExplodedNode *N = C.addTransition(State); if (!N) return; @@ -584,7 +584,7 @@ void MacOSKeychainAPIChecker::checkEndPath(CheckerContext &Ctx) const { if (!Changed) return; - ExplodedNode *N = Ctx.generateNode(state); + ExplodedNode *N = Ctx.addTransition(state); if (!N) return; diff --git a/lib/StaticAnalyzer/Checkers/MallocChecker.cpp b/lib/StaticAnalyzer/Checkers/MallocChecker.cpp index edea33ea69..f217df9309 100644 --- a/lib/StaticAnalyzer/Checkers/MallocChecker.cpp +++ b/lib/StaticAnalyzer/Checkers/MallocChecker.cpp @@ -197,7 +197,7 @@ bool MallocChecker::evalCall(const CallExpr *CE, CheckerContext &C) const { void MallocChecker::MallocMem(CheckerContext &C, const CallExpr *CE) { const ProgramState *state = MallocMemAux(C, CE, CE->getArg(0), UndefinedVal(), C.getState()); - C.generateNode(state); + C.addTransition(state); } void MallocChecker::MallocMemReturnsAttr(CheckerContext &C, const CallExpr *CE, @@ -209,12 +209,12 @@ void MallocChecker::MallocMemReturnsAttr(CheckerContext &C, const CallExpr *CE, if (I != E) { const ProgramState *state = MallocMemAux(C, CE, CE->getArg(*I), UndefinedVal(), C.getState()); - C.generateNode(state); + C.addTransition(state); return; } const ProgramState *state = MallocMemAux(C, CE, UnknownVal(), UndefinedVal(), C.getState()); - C.generateNode(state); + C.addTransition(state); } const ProgramState *MallocChecker::MallocMemAux(CheckerContext &C, @@ -252,7 +252,7 @@ void MallocChecker::FreeMem(CheckerContext &C, const CallExpr *CE) const { const ProgramState *state = FreeMemAux(C, CE, C.getState(), 0, false); if (state) - C.generateNode(state); + C.addTransition(state); } void MallocChecker::FreeMemAttr(CheckerContext &C, const CallExpr *CE, @@ -265,7 +265,7 @@ void MallocChecker::FreeMemAttr(CheckerContext &C, const CallExpr *CE, const ProgramState *state = FreeMemAux(C, CE, C.getState(), *I, Att->getOwnKind() == OwnershipAttr::Holds); if (state) - C.generateNode(state); + C.addTransition(state); } } @@ -531,7 +531,7 @@ void MallocChecker::ReallocMem(CheckerContext &C, const CallExpr *CE) const { const ProgramState *stateMalloc = MallocMemAux(C, CE, CE->getArg(1), UndefinedVal(), stateEqual); - C.generateNode(stateMalloc); + C.addTransition(stateMalloc); } if (const ProgramState *stateNotEqual = state->assume(PtrEQ, false)) { @@ -541,7 +541,7 @@ void MallocChecker::ReallocMem(CheckerContext &C, const CallExpr *CE) const { FreeMemAux(C, CE, stateSizeZero, 0, false)) { // Bind the return value to NULL because it is now free. - |