1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
| //===- unittests/StaticAnalyzer/CallDescriptionTest.cpp -------------------===//
//
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
// See https://llvm.org/LICENSE.txt for license information.
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
//
//===----------------------------------------------------------------------===//
#include "Reusables.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
#include "clang/Tooling/Tooling.h"
#include "gtest/gtest.h"
namespace clang {
namespace ento {
namespace {
// A wrapper around CallDescriptionMap<bool> that allows verifying that
// all functions have been found. This is needed because CallDescriptionMap
// isn't supposed to support iteration.
class ResultMap {
size_t Found, Total;
CallDescriptionMap<bool> Impl;
public:
ResultMap(std::initializer_list<std::pair<CallDescription, bool>> Data)
: Found(0),
Total(std::count_if(Data.begin(), Data.end(),
[](const std::pair<CallDescription, bool> &Pair) {
return Pair.second == true;
})),
Impl(std::move(Data)) {}
const bool *lookup(const CallEvent &Call) {
const bool *Result = Impl.lookup(Call);
// If it's a function we expected to find, remember that we've found it.
if (Result && *Result)
++Found;
return Result;
}
// Fail the test if we haven't found all the true-calls we were looking for.
~ResultMap() { EXPECT_EQ(Found, Total); }
};
// Scan the code body for call expressions and see if we find all calls that
// we were supposed to find ("true" in the provided ResultMap) and that we
// don't find the ones that we weren't supposed to find
// ("false" in the ResultMap).
class CallDescriptionConsumer : public ExprEngineConsumer {
ResultMap &RM;
void performTest(const Decl *D) {
using namespace ast_matchers;
if (!D->hasBody())
return;
const CallExpr *CE = findNode<CallExpr>(D, callExpr());
const StackFrameContext *SFC =
Eng.getAnalysisDeclContextManager().getStackFrame(D);
ProgramStateRef State = Eng.getInitialState(SFC);
CallEventRef<> Call =
Eng.getStateManager().getCallEventManager().getCall(CE, State, SFC);
const bool *LookupResult = RM.lookup(*Call);
// Check that we've found the function in the map
// with the correct description.
EXPECT_TRUE(LookupResult && *LookupResult);
// ResultMap is responsible for making sure that we've found *all* calls.
}
public:
CallDescriptionConsumer(CompilerInstance &C,
ResultMap &RM)
: ExprEngineConsumer(C), RM(RM) {}
bool HandleTopLevelDecl(DeclGroupRef DG) override {
for (const auto *D : DG)
performTest(D);
return true;
}
};
class CallDescriptionAction : public ASTFrontendAction {
ResultMap RM;
public:
CallDescriptionAction(
std::initializer_list<std::pair<CallDescription, bool>> Data)
: RM(Data) {}
std::unique_ptr<ASTConsumer> CreateASTConsumer(CompilerInstance &Compiler,
StringRef File) override {
return std::make_unique<CallDescriptionConsumer>(Compiler, RM);
}
};
TEST(CallEvent, CallDescription) {
// Test simple name matching.
EXPECT_TRUE(tooling::runToolOnCode(
std::unique_ptr<CallDescriptionAction>(new CallDescriptionAction({
{{"bar"}, false}, // false: there's no call to 'bar' in this code.
{{"foo"}, true}, // true: there's a call to 'foo' in this code.
})), "void foo(); void bar() { foo(); }"));
// Test arguments check.
EXPECT_TRUE(tooling::runToolOnCode(
std::unique_ptr<CallDescriptionAction>(new CallDescriptionAction({
{{"foo", 1}, true},
{{"foo", 2}, false},
})), "void foo(int); void foo(int, int); void bar() { foo(1); }"));
// Test lack of arguments check.
EXPECT_TRUE(tooling::runToolOnCode(
std::unique_ptr<CallDescriptionAction>(new CallDescriptionAction({
{{"foo", None}, true},
{{"foo", 2}, false},
})), "void foo(int); void foo(int, int); void bar() { foo(1); }"));
// Test qualified names.
EXPECT_TRUE(tooling::runToolOnCode(
std::unique_ptr<CallDescriptionAction>(new CallDescriptionAction({
{{{"std", "basic_string", "c_str"}}, true},
})),
"namespace std { inline namespace __1 {"
" template<typename T> class basic_string {"
" public:"
" T *c_str();"
" };"
"}}"
"void foo() {"
" using namespace std;"
" basic_string<char> s;"
" s.c_str();"
"}"));
// A negative test for qualified names.
EXPECT_TRUE(tooling::runToolOnCode(
std::unique_ptr<CallDescriptionAction>(new CallDescriptionAction({
{{{"foo", "bar"}}, false},
{{{"bar", "foo"}}, false},
{{"foo"}, true},
})), "void foo(); struct bar { void foo(); }; void test() { foo(); }"));
// Test CDF_MaybeBuiltin - a flag that allows matching weird builtins.
EXPECT_TRUE(tooling::runToolOnCode(
std::unique_ptr<CallDescriptionAction>(new CallDescriptionAction({
{{"memset", 3}, false},
{{CDF_MaybeBuiltin, "memset", 3}, true}
})),
"void foo() {"
" int x;"
" __builtin___memset_chk(&x, 0, sizeof(x),"
" __builtin_object_size(&x, 0));"
"}"));
}
} // namespace
} // namespace ento
} // namespace clang
|