bool ConditionBRVisitor::patternMatch(const Expr *Ex, raw_ostream &Out, BugReporterContext &BRC, BugReport &report, const ExplodedNode *N, Optional<bool> &prunable) { const Expr *OriginalExpr = Ex; Ex = Ex->IgnoreParenCasts(); if (const DeclRefExpr *DR = dyn_cast<DeclRefExpr>(Ex)) { const bool quotes = isa<VarDecl>(DR->getDecl()); if (quotes) { Out << '\''; const LocationContext *LCtx = N->getLocationContext(); const ProgramState *state = N->getState().getPtr(); if (const MemRegion *R = state->getLValue(cast<VarDecl>(DR->getDecl()), LCtx).getAsRegion()) { if (report.isInteresting(R)) prunable = false; else { const ProgramState *state = N->getState().getPtr(); SVal V = state->getSVal(R); if (report.isInteresting(V)) prunable = false; } } } Out << DR->getDecl()->getDeclName().getAsString(); if (quotes) Out << '\''; return quotes; } if (const IntegerLiteral *IL = dyn_cast<IntegerLiteral>(Ex)) { QualType OriginalTy = OriginalExpr->getType(); if (OriginalTy->isPointerType()) { if (IL->getValue() == 0) { Out << "null"; return false; } } else if (OriginalTy->isObjCObjectPointerType()) { if (IL->getValue() == 0) { Out << "nil"; return false; } } Out << IL->getValue(); return false; } return false; }
std::shared_ptr<PathDiagnosticPiece> DeleteWithNonVirtualDtorChecker::DeleteBugVisitor::VisitNode( const ExplodedNode *N, const ExplodedNode *PrevN, BugReporterContext &BRC, BugReport &BR) { // Stop traversal after the first conversion was found on a path. if (Satisfied) return nullptr; ProgramStateRef State = N->getState(); const LocationContext *LC = N->getLocationContext(); const Stmt *S = PathDiagnosticLocation::getStmt(N); if (!S) return nullptr; const auto *CastE = dyn_cast<CastExpr>(S); if (!CastE) return nullptr; // Only interested in DerivedToBase implicit casts. // Explicit casts can have different CastKinds. if (const auto *ImplCastE = dyn_cast<ImplicitCastExpr>(CastE)) { if (ImplCastE->getCastKind() != CK_DerivedToBase) return nullptr; } // Region associated with the current cast expression. const MemRegion *M = State->getSVal(CastE, LC).getAsRegion(); if (!M) return nullptr; // Check if target region was marked as problematic previously. if (!BR.isInteresting(M)) return nullptr; // Stop traversal on this path. Satisfied = true; SmallString<256> Buf; llvm::raw_svector_ostream OS(Buf); OS << "Conversion from derived to base happened here"; PathDiagnosticLocation Pos(S, BRC.getSourceManager(), N->getLocationContext()); return std::make_shared<PathDiagnosticEventPiece>(Pos, OS.str(), true, nullptr); }