void AnalyzerStatsChecker::checkEndAnalysis(ExplodedGraph &G,
BugReporter &B,
ExprEngine &Eng) const {
- const CFG *C = 0;
+ const CFG *C = nullptr;
const SourceManager &SM = B.getSourceManager();
llvm::SmallPtrSet<const CFGBlock*, 256> reachable;
private:
const SubRegion *baseRegion;
SVal byteOffset;
-
+
RegionRawOffsetV2()
- : baseRegion(0), byteOffset(UnknownVal()) {}
+ : baseRegion(nullptr), byteOffset(UnknownVal()) {}
public:
RegionRawOffsetV2(const SubRegion* base, SVal offset)
mutable std::unique_ptr<APIMisuse> BT;
mutable IdentifierInfo* II;
public:
- CFNumberCreateChecker() : II(0) {}
+ CFNumberCreateChecker() : II(nullptr) {}
void checkPreStmt(const CallExpr *CE, CheckerContext &C) const;
mutable std::unique_ptr<APIMisuse> BT;
mutable IdentifierInfo *Retain, *Release, *MakeCollectable;
public:
- CFRetainReleaseChecker(): Retain(0), Release(0), MakeCollectable(0) {}
+ CFRetainReleaseChecker()
+ : Retain(nullptr), Release(nullptr), MakeCollectable(nullptr) {}
void checkPreStmt(const CallExpr *CE, CheckerContext &C) const;
};
} // end anonymous namespace
CheckerContext &C) const;
public:
- ObjCLoopChecker() : CountSelectorII(0) {}
+ ObjCLoopChecker() : CountSelectorII(nullptr) {}
void checkPostStmt(const ObjCForCollectionStmt *FCS, CheckerContext &C) const;
void checkPostObjCMessage(const ObjCMethodCall &M, CheckerContext &C) const;
void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const;
ProgramStateRef State,
const ObjCForCollectionStmt *FCS) {
if (!State)
- return NULL;
+ return nullptr;
SVal CollectionVal = C.getSVal(FCS->getCollection());
Optional<DefinedSVal> KnownCollection = CollectionVal.getAs<DefinedSVal>();
std::tie(StNonNil, StNil) = State->assume(*KnownCollection);
if (StNil && !StNonNil) {
// The collection is nil. This path is infeasible.
- return NULL;
+ return nullptr;
}
return StNonNil;
ProgramStateRef State,
const ObjCForCollectionStmt *FCS) {
if (!State)
- return NULL;
+ return nullptr;
// See if the collection is one where we /know/ the elements are non-nil.
if (!isKnownNonNilCollectionType(FCS->getCollection()->getType()))
Optional<Loc> ElementLoc;
if (const DeclStmt *DS = dyn_cast<DeclStmt>(Element)) {
const VarDecl *ElemDecl = cast<VarDecl>(DS->getSingleDecl());
- assert(ElemDecl->getInit() == 0);
+ assert(ElemDecl->getInit() == nullptr);
ElementLoc = State->getLValue(ElemDecl, LCtx);
} else {
ElementLoc = State->getSVal(Element, LCtx).getAs<Loc>();
const bool *KnownNonEmpty = State->get<ContainerNonEmptyMap>(CollectionS);
if (!KnownNonEmpty)
return State->set<ContainerNonEmptyMap>(CollectionS, Assumption);
- return (Assumption == *KnownNonEmpty) ? State : NULL;
+ return (Assumption == *KnownNonEmpty) ? State : nullptr;
}
SValBuilder &SvalBuilder = C.getSValBuilder();
const ObjCForCollectionStmt *FCS,
bool Assumption) {
if (!State)
- return NULL;
+ return nullptr;
SymbolRef CollectionS =
State->getSVal(FCS->getCollection(), C.getLocationContext()).getAsSymbol();
static SymbolRef getMethodReceiverIfKnownImmutable(const CallEvent *Call) {
const ObjCMethodCall *Message = dyn_cast_or_null<ObjCMethodCall>(Call);
if (!Message)
- return 0;
+ return nullptr;
const ObjCMethodDecl *MD = Message->getDecl();
if (!MD)
- return 0;
+ return nullptr;
const ObjCInterfaceDecl *StaticClass;
if (isa<ObjCProtocolDecl>(MD->getDeclContext())) {
}
if (!StaticClass)
- return 0;
+ return nullptr;
switch (findKnownClass(StaticClass, /*IncludeSuper=*/false)) {
case FC_None:
- return 0;
+ return nullptr;
case FC_NSArray:
case FC_NSDictionary:
case FC_NSEnumerator:
ProgramStateRef state,
const Expr *S,
SVal l,
- const char *message = NULL) const;
+ const char *message = nullptr) const;
ProgramStateRef CheckBufferAccess(CheckerContext &C,
ProgramStateRef state,
const Expr *Size,
const Expr *FirstBuf,
const Expr *SecondBuf,
- const char *firstMessage = NULL,
- const char *secondMessage = NULL,
+ const char *firstMessage = nullptr,
+ const char *secondMessage = nullptr,
bool WarnAboutSize = false) const;
ProgramStateRef CheckBufferAccess(CheckerContext &C,
ProgramStateRef state,
const Expr *Size,
const Expr *Buf,
- const char *message = NULL,
+ const char *message = nullptr,
bool WarnAboutSize = false) const {
// This is a convenience override.
- return CheckBufferAccess(C, state, Size, Buf, NULL, message, NULL,
+ return CheckBufferAccess(C, state, Size, Buf, nullptr, message, nullptr,
WarnAboutSize);
}
ProgramStateRef CheckOverlap(CheckerContext &C,
const Expr *S, SVal l) const {
// If a previous check has failed, propagate the failure.
if (!state)
- return NULL;
+ return nullptr;
ProgramStateRef stateNull, stateNonNull;
std::tie(stateNull, stateNonNull) = assumeZero(C, state, l, S->getType());
if (stateNull && !stateNonNull) {
if (!Filter.CheckCStringNullArg)
- return NULL;
+ return nullptr;
ExplodedNode *N = C.generateSink(stateNull);
if (!N)
- return NULL;
+ return nullptr;
if (!BT_Null)
BT_Null.reset(new BuiltinBug(
report->addRange(S->getSourceRange());
bugreporter::trackNullOrUndefValue(N, S, *report);
C.emitReport(report);
- return NULL;
+ return nullptr;
}
// From here on, assume that the value is non-null.
const char *warningMsg) const {
// If a previous check has failed, propagate the failure.
if (!state)
- return NULL;
+ return nullptr;
// Check for out of bound array element access.
const MemRegion *R = l.getAsRegion();
if (StOutBound && !StInBound) {
ExplodedNode *N = C.generateSink(StOutBound);
if (!N)
- return NULL;
+ return nullptr;
if (!BT_Bounds) {
BT_Bounds.reset(new BuiltinBug(
report->addRange(S->getSourceRange());
C.emitReport(report);
- return NULL;
+ return nullptr;
}
// Array bound check succeeded. From this point forward the array bound
bool WarnAboutSize) const {
// If a previous check has failed, propagate the failure.
if (!state)
- return NULL;
+ return nullptr;
SValBuilder &svalBuilder = C.getSValBuilder();
ASTContext &Ctx = svalBuilder.getContext();
SVal BufVal = state->getSVal(FirstBuf, LCtx);
state = checkNonNull(C, state, FirstBuf, BufVal);
if (!state)
- return NULL;
+ return nullptr;
// If out-of-bounds checking is turned off, skip the rest.
if (!Filter.CheckCStringOutOfBounds)
// If the buffer isn't large enough, abort.
if (!state)
- return NULL;
+ return nullptr;
}
// If there's a second buffer, check it as well.
BufVal = state->getSVal(SecondBuf, LCtx);
state = checkNonNull(C, state, SecondBuf, BufVal);
if (!state)
- return NULL;
+ return nullptr;
BufStart = svalBuilder.evalCast(BufVal, PtrTy, SecondBuf->getType());
if (Optional<Loc> BufLoc = BufStart.getAs<Loc>()) {
// If a previous check has failed, propagate the failure.
if (!state)
- return NULL;
+ return nullptr;
ProgramStateRef stateTrue, stateFalse;
if (stateTrue && !stateFalse) {
// If the values are known to be equal, that's automatically an overlap.
emitOverlapBug(C, stateTrue, First, Second);
- return NULL;
+ return nullptr;
}
// assume the two expressions are not equal.
if (stateTrue && !stateFalse) {
// Overlap!
emitOverlapBug(C, stateTrue, First, Second);
- return NULL;
+ return nullptr;
}
// assume the two expressions don't overlap.
// If a previous check has failed, propagate the failure.
if (!state)
- return NULL;
+ return nullptr;
SValBuilder &svalBuilder = C.getSValBuilder();
BasicValueFactory &BVF = svalBuilder.getBasicValueFactory();
// We have an overflow. Emit a bug report.
ExplodedNode *N = C.generateSink(stateOverflow);
if (!N)
- return NULL;
+ return nullptr;
if (!BT_AdditionOverflow)
BT_AdditionOverflow.reset(
BugReport *report = new BugReport(*BT_AdditionOverflow, warning, N);
C.emitReport(report);
- return NULL;
+ return nullptr;
}
// From now on, assume an overflow didn't occur.
// Get the memory region pointed to by the val.
const MemRegion *bufRegion = val.getAsRegion();
if (!bufRegion)
- return NULL;
+ return nullptr;
// Strip casts off the memory region.
bufRegion = bufRegion->StripCasts();
// Cast the memory region to a string region.
const StringRegion *strRegion= dyn_cast<StringRegion>(bufRegion);
if (!strRegion)
- return NULL;
+ return nullptr;
// Return the actual string in the string region.
return strRegion->getStringLiteral();
}
return state->invalidateRegions(R, E, C.blockCount(), LCtx,
- CausesPointerEscape, 0, 0, &ITraits);
+ CausesPointerEscape, nullptr, nullptr,
+ &ITraits);
}
// If we have a non-region value by chance, just remove the binding.
const char * const writeWarning =
"Memory copy function overflows destination buffer";
state = CheckBufferAccess(C, state, Size, Dest, Source,
- writeWarning, /* sourceWarning = */ NULL);
+ writeWarning, /* sourceWarning = */ nullptr);
if (Restricted)
state = CheckOverlap(C, state, Size, Dest, Source);
} else {
// If we don't know how much we copied, we can at least
// conjure a return value for later.
- SVal result = C.getSValBuilder().conjureSymbolVal(0, CE, LCtx,
+ SVal result = C.getSValBuilder().conjureSymbolVal(nullptr, CE, LCtx,
C.blockCount());
state = state->BindExpr(CE, LCtx, result);
}
state = CheckBufferAccess(C, state, Size, Left, Right);
if (state) {
// The return value is the comparison result, which we don't know.
- SVal CmpV = svalBuilder.conjureSymbolVal(0, CE, LCtx, C.blockCount());
+ SVal CmpV = svalBuilder.conjureSymbolVal(nullptr, CE, LCtx,
+ C.blockCount());
state = state->BindExpr(CE, LCtx, CmpV);
C.addTransition(state);
}
// no guarantee the full string length will actually be returned.
// All we know is the return value is the min of the string length
// and the limit. This is better than nothing.
- result = C.getSValBuilder().conjureSymbolVal(0, CE, LCtx, C.blockCount());
+ result = C.getSValBuilder().conjureSymbolVal(nullptr, CE, LCtx,
+ C.blockCount());
NonLoc resultNL = result.castAs<NonLoc>();
if (strLengthNL) {
// If we don't know the length of the string, conjure a return
// value, so it can be used in constraints, at least.
if (result.isUnknown()) {
- result = C.getSValBuilder().conjureSymbolVal(0, CE, LCtx, C.blockCount());
+ result = C.getSValBuilder().conjureSymbolVal(nullptr, CE, LCtx,
+ C.blockCount());
}
}
// - potential overflows caused by a bound that could exceed the destination
SVal amountCopied = UnknownVal();
SVal maxLastElementIndex = UnknownVal();
- const char *boundWarning = NULL;
+ const char *boundWarning = nullptr;
// If the function is strncpy, strncat, etc... it is bounded.
if (isBounded) {
// If this is a stpcpy-style copy, but we were unable to check for a buffer
// overflow, we still need a result. Conjure a return value.
if (returnEnd && Result.isUnknown()) {
- Result = svalBuilder.conjureSymbolVal(0, CE, LCtx, C.blockCount());
+ Result = svalBuilder.conjureSymbolVal(nullptr, CE, LCtx, C.blockCount());
}
// Set the return value.
if (!canComputeResult) {
// Conjure a symbolic value. It's the best we can do.
- SVal resultVal = svalBuilder.conjureSymbolVal(0, CE, LCtx, C.blockCount());
+ SVal resultVal = svalBuilder.conjureSymbolVal(nullptr, CE, LCtx,
+ C.blockCount());
state = state->BindExpr(CE, LCtx, resultVal);
}
} else {
assert(SearchStrVal.isUnknown());
// Conjure a symbolic value. It's the best we can do.
- Result = SVB.conjureSymbolVal(0, CE, LCtx, C.blockCount());
+ Result = SVB.conjureSymbolVal(nullptr, CE, LCtx, C.blockCount());
}
// Set the return value, and finish.
return false;
// FIXME: Poorly-factored string switches are slow.
- FnCheck evalFunction = 0;
+ FnCheck evalFunction = nullptr;
if (C.isCLibraryFunction(FDecl, "memcpy"))
evalFunction = &CStringChecker::evalMemcpy;
else if (C.isCLibraryFunction(FDecl, "mempcpy"))
// Make sure each function sets its own description.
// (But don't bother in a release build.)
- assert(!(CurrentFunctionDescription = NULL));
+ assert(!(CurrentFunctionDescription = nullptr));
// Check and evaluate the call.
(this->*evalFunction)(C, CE);
BT = &BT_call_arg;
for (unsigned i = 0, e = Call.getNumArgs(); i != e; ++i) {
- const ParmVarDecl *ParamDecl = NULL;
+ const ParmVarDecl *ParamDecl = nullptr;
if(FD && i < FD->getNumParams())
ParamDecl = FD->getParamDecl(i);
if (PreVisitProcessArg(C, Call.getArgSVal(i), Call.getArgSourceRange(i),
SVal recVal = msg.getReceiverSVal();
if (recVal.isUndef()) {
if (ExplodedNode *N = C.generateSink()) {
- BugType *BT = 0;
+ BugType *BT = nullptr;
switch (msg.getMessageKind()) {
case OCM_Message:
if (!BT_msg_undef)
Ctx.LongDoubleTy == CanRetTy ||
Ctx.LongLongTy == CanRetTy ||
Ctx.UnsignedLongLongTy == CanRetTy)))) {
- if (ExplodedNode *N = C.generateSink(state, 0 , &Tag))
+ if (ExplodedNode *N = C.generateSink(state, nullptr, &Tag))
emitNilReceiverBug(C, Msg, N);
return;
}
const RecordDecl *RD = RT->getDecl();
RecordDecl::field_iterator Iter(RD->field_begin());
RecordDecl::field_iterator End(RD->field_end());
- const FieldDecl *Last = 0;
+ const FieldDecl *Last = nullptr;
for (; Iter != End; ++Iter)
Last = *Iter;
assert(Last && "empty structs should already be handled");
ProgramStateRef state = C.getState();
const MemRegion *R = state->getSVal(E, C.getLocationContext()).getAsRegion();
- if (R == 0)
+ if (!R)
return;
const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(R);
- if (SR == 0)
+ if (!SR)
return;
SValBuilder &svalBuilder = C.getSValBuilder();
// Get the "dealloc" selector.
IdentifierInfo* II = &Ctx.Idents.get("dealloc");
Selector S = Ctx.Selectors.getSelector(0, &II);
- const ObjCMethodDecl *MD = 0;
+ const ObjCMethodDecl *MD = nullptr;
// Scan the instance methods for "dealloc".
for (const auto *I : D->instance_methods()) {
bool requiresRelease = PD->getSetterKind() != ObjCPropertyDecl::Assign;
if (scan_ivar_release(MD->getBody(), ID, PD, RS, SelfII, Ctx)
!= requiresRelease) {
- const char *name = 0;
+ const char *name = nullptr;
std::string buf;
llvm::raw_string_ostream os(buf);
MapTy::iterator MI = IMeths.find(S);
- if (MI == IMeths.end() || MI->second == 0)
+ if (MI == IMeths.end() || MI->second == nullptr)
continue;
--NumMethods;
ObjCMethodDecl *MethDerived = MI->second;
- MI->second = 0;
+ MI->second = nullptr;
CompareReturnTypes(MethDerived, M, BR, Ctx, ID, Checker);
}
.Case("rand_r", &WalkAST::checkCall_rand)
.Case("random", &WalkAST::checkCall_random)
.Case("vfork", &WalkAST::checkCall_vfork)
- .Default(NULL);
+ .Default(nullptr);
// If the callee isn't defined, it is not of security concern.
// Check and evaluate the call.
if (const BinaryOperator *B = dyn_cast<BinaryOperator>(expr)) {
if (!(B->isAssignmentOp() || B->isCompoundAssignmentOp() ||
B->getOpcode() == BO_Comma))
- return NULL;
+ return nullptr;
if (const DeclRefExpr *lhs = getIncrementedVar(B->getLHS(), x, y))
return lhs;
if (const DeclRefExpr *rhs = getIncrementedVar(B->getRHS(), x, y))
return rhs;
- return NULL;
+ return nullptr;
}
if (const DeclRefExpr *DR = dyn_cast<DeclRefExpr>(expr)) {
const NamedDecl *ND = DR->getDecl();
- return ND == x || ND == y ? DR : NULL;
+ return ND == x || ND == y ? DR : nullptr;
}
if (const UnaryOperator *U = dyn_cast<UnaryOperator>(expr))
return U->isIncrementDecrementOp()
- ? getIncrementedVar(U->getSubExpr(), x, y) : NULL;
+ ? getIncrementedVar(U->getSubExpr(), x, y) : nullptr;
- return NULL;
+ return nullptr;
}
/// CheckLoopConditionForFloat - This check looks for 'for' statements that
dyn_cast<DeclRefExpr>(B->getRHS()->IgnoreParenLValueCasts());
// Does at least one of the variables have a floating point type?
- drLHS = drLHS && drLHS->getType()->isRealFloatingType() ? drLHS : NULL;
- drRHS = drRHS && drRHS->getType()->isRealFloatingType() ? drRHS : NULL;
+ drLHS = drLHS && drLHS->getType()->isRealFloatingType() ? drLHS : nullptr;
+ drRHS = drRHS && drRHS->getType()->isRealFloatingType() ? drRHS : nullptr;
if (!drLHS && !drRHS)
return;
- const VarDecl *vdLHS = drLHS ? dyn_cast<VarDecl>(drLHS->getDecl()) : NULL;
- const VarDecl *vdRHS = drRHS ? dyn_cast<VarDecl>(drRHS->getDecl()) : NULL;
+ const VarDecl *vdLHS = drLHS ? dyn_cast<VarDecl>(drLHS->getDecl()) : nullptr;
+ const VarDecl *vdRHS = drRHS ? dyn_cast<VarDecl>(drRHS->getDecl()) : nullptr;
if (!vdLHS && !vdRHS)
return;
if (!FD)
return;
- if (II_setid[0] == NULL) {
+ if (II_setid[0] == nullptr) {
static const char * const identifiers[num_setids] = {
"setuid", "setgid", "seteuid", "setegid",
"setreuid", "setregid"
mutable std::unique_ptr<BuiltinBug> BT_BreakJail;
public:
- ChrootChecker() : II_chroot(0), II_chdir(0) {}
-
+ ChrootChecker() : II_chroot(nullptr), II_chdir(nullptr) {}
+
static void *getTag() {
static int x;
return &x;
ParentMap &parents,
llvm::SmallPtrSet<const VarDecl *, 20> &escaped)
: cfg(cfg), Ctx(ctx), BR(br), Checker(checker), AC(ac), Parents(parents),
- Escaped(escaped), currentBlock(0) {}
+ Escaped(escaped), currentBlock(nullptr) {}
virtual ~DeadStoreObs() {}
SmallString<64> buf;
llvm::raw_svector_ostream os(buf);
- const char *BugType = 0;
+ const char *BugType = nullptr;
switch (dsk) {
case DeadInit:
const Expr *RecE = MsgE->getInstanceReceiver();
if (!RecE)
- return 0;
+ return nullptr;
RecE= RecE->IgnoreParenImpCasts();
if (const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(RecE)) {
return ObjTy;
}
}
- return 0;
+ return nullptr;
}
// Return a better dynamic type if one can be derived from the cast.
const ObjCObjectPointerType *NewTy =
CastE->getType()->getAs<ObjCObjectPointerType>();
if (!NewTy)
- return 0;
+ return nullptr;
QualType OldDTy = C.getState()->getDynamicTypeInfo(ToR).getType();
if (OldDTy.isNull()) {
return NewTy;
const ObjCObjectPointerType *OldTy =
OldDTy->getAs<ObjCObjectPointerType>();
if (!OldTy)
- return 0;
+ return nullptr;
// Id the old type is 'id', the new one is more precise.
if (OldTy->isObjCIdType() && !NewTy->isObjCIdType())
if (ToI && FromI && FromI->isSuperClassOf(ToI))
return NewTy;
- return 0;
+ return nullptr;
}
void ento::registerDynamicTypePropagation(CheckerManager &mgr) {
&ExprInspectionChecker::analyzerCheckInlined)
.Case("clang_analyzer_crash", &ExprInspectionChecker::analyzerCrash)
.Case("clang_analyzer_warnIfReached", &ExprInspectionChecker::analyzerWarnIfReached)
- .Default(0);
+ .Default(nullptr);
if (!Handler)
return false;
// A specific instantiation of an inlined function may have more constrained
// values than can generally be assumed. Skip the check.
- if (LC->getCurrentStackFrame()->getParent() != 0)
+ if (LC->getCurrentStackFrame()->getParent() != nullptr)
return;
if (!BT)
// when we are analyzing it as an inlined function. This means that
// clang_analyzer_checkInlined(true) should always print TRUE, but
// clang_analyzer_checkInlined(false) should never actually print anything.
- if (LC->getCurrentStackFrame()->getParent() == 0)
+ if (LC->getCurrentStackFrame()->getParent() == nullptr)
return;
if (!BT)
void GenericTaintChecker::addSourcesPre(const CallExpr *CE,
CheckerContext &C) const {
- ProgramStateRef State = 0;
+ ProgramStateRef State = nullptr;
const FunctionDecl *FDecl = C.getCalleeDecl(CE);
if (!FDecl || FDecl->getKind() != Decl::Function)
return;
// Otherwise, check if we have custom pre-processing implemented.
FnCheck evalFunction = llvm::StringSwitch<FnCheck>(Name)
.Case("fscanf", &GenericTaintChecker::preFscanf)
- .Default(0);
+ .Default(nullptr);
// Check and evaluate the call.
if (evalFunction)
State = (this->*evalFunction)(CE, C);
.Case("getch", &GenericTaintChecker::postRetTaint)
.Case("wgetch", &GenericTaintChecker::postRetTaint)
.Case("socket", &GenericTaintChecker::postSocket)
- .Default(0);
+ .Default(nullptr);
// If the callee isn't defined, it is not of security concern.
// Check and evaluate the call.
- ProgramStateRef State = 0;
+ ProgramStateRef State = nullptr;
if (evalFunction)
State = (this->*evalFunction)(CE, C);
if (!State)
ProgramStateRef State = C.getState();
SVal AddrVal = State->getSVal(Arg->IgnoreParens(), C.getLocationContext());
if (AddrVal.isUnknownOrUndef())
- return 0;
+ return nullptr;
Optional<Loc> AddrLoc = AddrVal.getAs<Loc>();
if (!AddrLoc)
- return 0;
+ return nullptr;
const PointerType *ArgTy =
dyn_cast<PointerType>(Arg->getType().getCanonicalType().getTypePtr());
return State;
}
- return 0;
+ return nullptr;
}
PropertySetterToIvarMap(InPropertySetterToIvarMap),
PropertyGetterToIvarMap(InPropertyGetterToIvarMap),
PropertyToIvarMap(InPropertyToIvarMap),
- InvalidationMethod(0),
+ InvalidationMethod(nullptr),
Ctx(InCtx) {}
void VisitStmt(const Stmt *S) { VisitChildren(S); }
const ObjCInterfaceDecl *InterfaceD,
IvarSet &TrackedIvars,
const ObjCIvarDecl **FirstIvarDecl) {
- const ObjCIvarDecl *IvarD = 0;
+ const ObjCIvarDecl *IvarD = nullptr;
// Lookup for the synthesized case.
IvarD = Prop->getPropertyIvarDecl();
// Note, this is a possible source of false positives. We could look at the
// getter implementation to find the ivar when its name is not derived from
// the property name.
- return 0;
+ return nullptr;
}
void IvarInvalidationCheckerImpl::printIvar(llvm::raw_svector_ostream &os,
// Record the first Ivar needing invalidation; used in reporting when only
// one ivar is sufficient. Cannot grab the first on the Ivars set to ensure
// deterministic output.
- const ObjCIvarDecl *FirstIvarDecl = 0;
+ const ObjCIvarDecl *FirstIvarDecl = nullptr;
const ObjCInterfaceDecl *InterfaceD = ImplD->getClassInterface();
// Collect ivars declared in this class, its extensions and its implementation
// invalidation methods.
for (IvarSet::const_iterator
I = Ivars.begin(), E = Ivars.end(); I != E; ++I)
- reportIvarNeedsInvalidation(I->first, IvarToPopertyMap, 0);
+ reportIvarNeedsInvalidation(I->first, IvarToPopertyMap, nullptr);
} else {
// Otherwise, no invalidation methods were implemented.
reportNoInvalidationMethod(Filter.checkName_InstanceVariableInvalidation,
if (Receiver) {
InvalidationMethod = MD;
check(Receiver->IgnoreParenCasts());
- InvalidationMethod = 0;
+ InvalidationMethod = nullptr;
}
VisitStmt(ME);
if (sym)
return sym;
}
- return 0;
+ return nullptr;
}
// When checking for error code, we need to consider the following cases:
// If the argument entered as an enclosing function parameter, skip it to
// avoid false positives.
if (isEnclosingFunctionParam(ArgExpr) &&
- C.getLocationContext()->getParent() == 0)
+ C.getLocationContext()->getParent() == nullptr)
return;
if (SymbolRef V = getAsPointeeSymbol(ArgExpr, C)) {
// symbol was tracked.
if (N->getLocationContext() == LeakContext)
AllocNode = N;
- N = N->pred_empty() ? NULL : *(N->pred_begin());
+ N = N->pred_empty() ? nullptr : *(N->pred_begin());
}
return AllocNode;
// allocated, and only report a single path.
PathDiagnosticLocation LocUsedForUniqueing;
const ExplodedNode *AllocNode = getAllocationNode(N, AP.first, C);
- const Stmt *AllocStmt = 0;
+ const Stmt *AllocStmt = nullptr;
ProgramPoint P = AllocNode->getLocation();
if (Optional<CallExitEnd> Exit = P.getAs<CallExitEnd>())
AllocStmt = Exit->getCalleeContext()->getCallSite();
BugReport &BR) {
const AllocationState *AS = N->getState()->get<AllocatedData>(Sym);
if (!AS)
- return 0;
+ return nullptr;
const AllocationState *ASPrev = PrevN->getState()->get<AllocatedData>(Sym);
if (ASPrev)
- return 0;
+ return nullptr;
// (!ASPrev && AS) ~ We started tracking symbol in node N, it must be the
// allocation site.
"_dispatch_once",
"dispatch_once_f",
&MacOSXAPIChecker::CheckDispatchOnce)
- .Default(NULL);
+ .Default(nullptr);
if (SC)
(this->*SC)(C, CE, Name);
eval::Assume>
{
public:
- MallocChecker() : II_malloc(0), II_free(0), II_realloc(0), II_calloc(0),
- II_valloc(0), II_reallocf(0), II_strndup(0), II_strdup(0),
- II_kmalloc(0) {}
+ MallocChecker()
+ : II_malloc(nullptr), II_free(nullptr), II_realloc(nullptr),
+ II_calloc(nullptr), II_valloc(nullptr), II_reallocf(nullptr),
+ II_strndup(nullptr), II_strdup(nullptr), II_kmalloc(nullptr) {}
/// In pessimistic mode, the checker assumes that it does not know which
/// functions might free the memory.
SymbolRef Sym, bool OwnershipTransferred) const;
void ReportOffsetFree(CheckerContext &C, SVal ArgVal, SourceRange Range,
const Expr *DeallocExpr,
- const Expr *AllocExpr = 0) const;
+ const Expr *AllocExpr = nullptr) const;
void ReportUseAfterFree(CheckerContext &C, SourceRange Range,
SymbolRef Sym) const;
void ReportDoubleFree(CheckerContext &C, SourceRange Range, bool Released,
public:
MallocBugVisitor(SymbolRef S, bool isLeak = false)
- : Sym(S), Mode(Normal), FailedReallocSymbol(0), IsLeak(isLeak) {}
+ : Sym(S), Mode(Normal), FailedReallocSymbol(nullptr), IsLeak(isLeak) {}
virtual ~MallocBugVisitor() {}
const ExplodedNode *EndPathNode,
BugReport &BR) override {
if (!IsLeak)
- return 0;
+ return nullptr;
PathDiagnosticLocation L =
PathDiagnosticLocation::createEndOfPath(EndPathNode,
MallocChecker::MallocMemReturnsAttr(CheckerContext &C, const CallExpr *CE,
const OwnershipAttr *Att) const {
if (Att->getModule() != II_malloc)
- return 0;
+ return nullptr;
OwnershipAttr::args_iterator I = Att->args_begin(), E = Att->args_end();
if (I != E) {
// We expect the malloc functions to return a pointer.
if (!RetVal.getAs<Loc>())
- return 0;
+ return nullptr;
// Fill the region with the initialization value.
State = State->bindDefault(RetVal, Init);
const SymbolicRegion *R =
dyn_cast_or_null<SymbolicRegion>(RetVal.getAsRegion());
if (!R)
- return 0;
+ return nullptr;
if (Optional<DefinedOrUnknownSVal> DefinedSize =
Size.getAs<DefinedOrUnknownSVal>()) {
SValBuilder &svalBuilder = C.getSValBuilder();
// We expect the malloc functions to return a pointer.
if (!retVal.getAs<Loc>())
- return 0;
+ return nullptr;
SymbolRef Sym = retVal.getAsLocSymbol();
assert(Sym);
const CallExpr *CE,
const OwnershipAttr *Att) const {
if (Att->getModule() != II_malloc)
- return 0;
+ return nullptr;
ProgramStateRef State = C.getState();
bool ReleasedAllocated = false;
bool &ReleasedAllocated,
bool ReturnsNullOnFailure) const {
if (CE->getNumArgs() < (Num + 1))
- return 0;
+ return nullptr;
return FreeMemAux(C, CE->getArg(Num), CE, state, Hold,
ReleasedAllocated, ReturnsNullOnFailure);
SVal ArgVal = State->getSVal(ArgExpr, C.getLocationContext());
if (!ArgVal.getAs<DefinedOrUnknownSVal>())
- return 0;
+ return nullptr;
DefinedOrUnknownSVal location = ArgVal.castAs<DefinedOrUnknownSVal>();
// Check for null dereferences.
if (!location.getAs<Loc>())
- return 0;
+ return nullptr;
// The explicit NULL case, no operation is performed.
ProgramStateRef notNullState, nullState;
std::tie(notNullState, nullState) = State->assume(location);
if (nullState && !notNullState)
- return 0;
+ return nullptr;
// Unknown values could easily be okay
// Undefined values are handled elsewhere
if (ArgVal.isUnknownOrUndef())
- return 0;
+ return nullptr;
const MemRegion *R = ArgVal.getAsRegion();
// Non-region locations (labels and fixed addresses) also shouldn't be freed.
if (!R) {
ReportBadFree(C, ArgVal, ArgExpr->getSourceRange(), ParentExpr);
- return 0;
+ return nullptr;
}
R = R->StripCasts();
// Blocks might show up as heap data, but should not be free()d
if (isa<BlockDataRegion>(R)) {
ReportBadFree(C, ArgVal, ArgExpr->getSourceRange(), ParentExpr);
- return 0;
+ return nullptr;
}
const MemSpaceRegion *MS = R->getMemorySpace();
// False negatives are better than false positives.
ReportBadFree(C, ArgVal, ArgExpr->getSourceRange(), ParentExpr);
- return 0;
+ return nullptr;
}
const SymbolicRegion *SrBase = dyn_cast<SymbolicRegion>(R->getBaseRegion());
// Various cases could lead to non-symbol values here.
// For now, ignore them.
if (!SrBase)
- return 0;
+ return nullptr;
SymbolRef SymBase = SrBase->getSymbol();
const RefState *RsBase = State->get<RegionState>(SymBase);
- SymbolRef PreviousRetStatusSymbol = 0;
+ SymbolRef PreviousRetStatusSymbol = nullptr;
if (RsBase) {
!didPreviousFreeFail(State, SymBase, PreviousRetStatusSymbol)) {
ReportDoubleFree(C, ParentExpr->getSourceRange(), RsBase->isReleased(),
SymBase, PreviousRetStatusSymbol);
- return 0;
+ return nullptr;
// If the pointer is allocated or escaped, but we are now trying to free it,
// check that the call to free is proper.
if (!DeallocMatchesAlloc) {
ReportMismatchedDealloc(C, ArgExpr->getSourceRange(),
ParentExpr, RsBase, SymBase, Hold);
- return 0;
+ return nullptr;
}
// Check if the memory location being freed is the actual location
const Expr *AllocExpr = cast<Expr>(RsBase->getStmt());
ReportOffsetFree(C, ArgVal, ArgExpr->getSourceRange(), ParentExpr,
AllocExpr);
- return 0;
+ return nullptr;
}
}
}
- ReleasedAllocated = (RsBase != 0) && RsBase->isAllocated();
+ ReleasedAllocated = (RsBase != nullptr) && RsBase->isAllocated();
// Clean out the info on previous call to free return info.
State = State->remove<FreeReturnValue>(SymBase);
if (VR)
VD = VR->getDecl();
else
- VD = NULL;
-
+ VD = nullptr;
+
if (VD)
os << "the address of the local variable '" << VD->getName() << "'";
else
if (VR)
VD = VR->getDecl();
else
- VD = NULL;
-
+ VD = nullptr;
+
if (VD)
os << "the address of the parameter '" << VD->getName() << "'";
else
if (VR)
VD = VR->getDecl();
else
- VD = NULL;
-
+ VD = nullptr;
+
if (VD) {
if (VD->isStaticLocal())
os << "the address of the static variable '" << VD->getName() << "'";
return;
ExplodedNode *N = C.generateSink();
- if (N == NULL)
+ if (!N)
return;
if (!BT_OffsetFree[*CheckKind])
const CallExpr *CE,
bool FreesOnFail) const {
if (CE->getNumArgs() < 2)
- return 0;
+ return nullptr;
ProgramStateRef state = C.getState();
const Expr *arg0Expr = CE->getArg(0);
const LocationContext *LCtx = C.getLocationContext();
SVal Arg0Val = state->getSVal(arg0Expr, LCtx);
if (!Arg0Val.getAs<DefinedOrUnknownSVal>())
- return 0;
+ return nullptr;
DefinedOrUnknownSVal arg0Val = Arg0Val.castAs<DefinedOrUnknownSVal>();
SValBuilder &svalBuilder = C.getSValBuilder();
// Get the size argument. If there is no size arg then give up.
const Expr *Arg1 = CE->getArg(1);
if (!Arg1)
- return 0;
+ return nullptr;
// Get the value of the size argument.
SVal Arg1ValG = state->getSVal(Arg1, LCtx);
if (!Arg1ValG.getAs<DefinedOrUnknownSVal>())
- return 0;
+ return nullptr;
DefinedOrUnknownSVal Arg1Val = Arg1ValG.castAs<DefinedOrUnknownSVal>();
// Compare the size argument to 0.
}
if (PrtIsNull && SizeIsZero)
- return 0;
+ return nullptr;
// Get the from and to pointer symbols as in toPtr = realloc(fromPtr, size).
assert(!PrtIsNull);
SVal RetVal = state->getSVal(CE, LCtx);
SymbolRef ToPtr = RetVal.getAsSymbol();
if (!FromPtr || !ToPtr)
- return 0;
+ return nullptr;
bool ReleasedAllocated = false;
ProgramStateRef stateRealloc = MallocMemAux(C, CE, CE->getArg(1),
UnknownVal(), stateFree);
if (!stateRealloc)
- return 0;
+ return nullptr;
ReallocPairKind Kind = RPToBeFreedAfterFailure;
if (FreesOnFail)
C.getSymbolManager().addSymbolDependency(ToPtr, FromPtr);
return stateRealloc;
}
- return 0;
+ return nullptr;
}
ProgramStateRef MallocChecker::CallocMem(CheckerContext &C, const CallExpr *CE){
if (CE->getNumArgs() < 2)
- return 0;
+ return nullptr;
ProgramStateRef state = C.getState();
SValBuilder &svalBuilder = C.getSValBuilder();
// Walk the ExplodedGraph backwards and find the first node that referred to
// the tracked symbol.
const ExplodedNode *AllocNode = N;
- const MemRegion *ReferenceRegion = 0;
+ const MemRegion *ReferenceRegion = nullptr;
while (N) {
ProgramStateRef State = N->getState();
// symbol was tracked.
if (N->getLocationContext() == LeakContext)
AllocNode = N;
- N = N->pred_empty() ? NULL : *(N->pred_begin());
+ N = N->pred_empty() ? nullptr : *(N->pred_begin());
}
return LeakInfo(AllocNode, ReferenceRegion);
// With leaks, we want to unique them by the location where they were
// allocated, and only report a single path.
PathDiagnosticLocation LocUsedForUniqueing;
- const ExplodedNode *AllocNode = 0;
- const MemRegion *Region = 0;
+ const ExplodedNode *AllocNode = nullptr;
+ const MemRegion *Region = nullptr;
std::tie(AllocNode, Region) = getAllocationSite(N, Sym, C);
ProgramPoint P = AllocNode->getLocation();
- const Stmt *AllocationStmt = 0;
+ const Stmt *AllocationStmt = nullptr;
if (Optional<CallExitEnd> Exit = P.getAs<CallExitEnd>())
AllocationStmt = Exit->getCalleeContext()->getCallSite();
else if (Optional<StmtPoint> SP = P.getAs<StmtPoint>())
ProgramStateRef State,
SymbolRef &EscapingSymbol) const {
assert(Call);
- EscapingSymbol = 0;
-
+ EscapingSymbol = nullptr;
+
// For now, assume that any C++ or block call can free memory.
// TODO: If we want to be more optimistic here, we'll need to make sure that
// regions escape to C++ containers. They seem to do that even now, but for
bool(*CheckRefState)(const RefState*)) const {
// If we know that the call does not free memory, or we want to process the
// call later, keep tracking the top level arguments.
- SymbolRef EscapingSymbol = 0;
+ SymbolRef EscapingSymbol = nullptr;
if (Kind == PSK_DirectEscapeOnCall &&
!mayFreeAnyEscapedMemoryOrIsModeledExplicitly(Call, State,
EscapingSymbol) &&
return sym;
}
- return NULL;
+ return nullptr;
}
PathDiagnosticPiece *
const RefState *RS = state->get<RegionState>(Sym);
const RefState *RSPrev = statePrev->get<RegionState>(Sym);
if (!RS)
- return 0;
+ return nullptr;
- const Stmt *S = 0;
- const char *Msg = 0;
- StackHintGeneratorForSymbol *StackHint = 0;
+ const Stmt *S = nullptr;
+ const char *Msg = nullptr;
+ StackHintGeneratorForSymbol *StackHint = nullptr;
// Retrieve the associated statement.
ProgramPoint ProgLoc = N->getLocation();
}
if (!S)
- return 0;
+ return nullptr;
// FIXME: We will eventually need to handle non-statement-based events
// (__attribute__((cleanup))).
Msg = "Attempt to reallocate memory";
StackHint = new StackHintGeneratorForSymbol(Sym,
"Returned reallocated memory");
- FailedReallocSymbol = NULL;
+ FailedReallocSymbol = nullptr;
Mode = Normal;
}
}
if (!Msg)
- return 0;
+ return nullptr;
assert(StackHint);
// Generate the extra diagnostic.
conditional expression, an operation that could reduce the range
of the result, or anything too complicated :-). */
const Expr * e = TheArgument;
- const BinaryOperator * mulop = NULL;
+ const BinaryOperator * mulop = nullptr;
for (;;) {
e = e->IgnoreParenImpCasts();
const BinaryOperator * binop = dyn_cast<BinaryOperator>(e);
BinaryOperatorKind opc = binop->getOpcode();
// TODO: ignore multiplications by 1, reject if multiplied by 0.
- if (mulop == NULL && opc == BO_Mul)
+ if (mulop == nullptr && opc == BO_Mul)
mulop = binop;
if (opc != BO_Mul && opc != BO_Add && opc != BO_Sub && opc != BO_Shl)
return;
return;
}
- if (mulop == NULL)
+ if (mulop == nullptr)
return;
// We've found the right structure of malloc argument, now save
if (FD) {
IdentifierInfo *II = FD->getIdentifier();
if (II == II_malloc || II == II_calloc || II == II_realloc)
- return TypeCallPair((const TypeSourceInfo *)0, E);
+ return TypeCallPair((const TypeSourceInfo *)nullptr, E);
}
return TypeCallPair();
}
if (compatibleWithArrayType(BR.getContext(), PointeeType, SizeofType))
continue;
- const TypeSourceInfo *TSI = 0;
+ const TypeSourceInfo *TSI = nullptr;
if (i->CastedExprParent.is<const VarDecl *>()) {
TSI =
i->CastedExprParent.get<const VarDecl *>()->getTypeSourceInfo();
mutable IdentifierInfo *II;
public:
- NSErrorMethodChecker() : II(0) { }
+ NSErrorMethodChecker() : II(nullptr) {}
void checkASTDecl(const ObjCMethodDecl *D,
AnalysisManager &mgr, BugReporter &BR) const;
mutable IdentifierInfo *II;
public:
- CFErrorFunctionChecker() : II(0) { }
+ CFErrorFunctionChecker() : II(nullptr) {}
void checkASTDecl(const FunctionDecl *D,
AnalysisManager &mgr, BugReporter &BR) const;
mutable std::unique_ptr<CFErrorDerefBug> CFBT;
public:
bool ShouldCheckNSError, ShouldCheckCFError;
- NSOrCFErrorDerefChecker() : NSErrorII(0), CFErrorII(0),
+ NSOrCFErrorDerefChecker() : NSErrorII(nullptr), CFErrorII(nullptr),
ShouldCheckNSError(0), ShouldCheckCFError(0) { }
void checkLocation(SVal loc, bool isLoad, const Stmt *S,
os << " may be null";
- BugType *bug = 0;
+ BugType *bug = nullptr;
if (isNSError) {
if (!NSBT)
NSBT.reset(new NSErrorDerefBug(this));
// we cache out.
if (ExplodedNode *errorNode = C.generateSink(stateNull)) {
- BugReport *R = 0;
+ BugReport *R = nullptr;
if (haveAttrNonNull)
R = genReportNullAttrNonNull(errorNode, ArgE);
else if (haveRefTypeParam)
ErrorNode);
if (ArgE) {
const Expr *ArgEDeref = bugreporter::getDerefExpr(ArgE);
- if (ArgEDeref == 0)
+ if (!ArgEDeref)
ArgEDeref = ArgE;
bugreporter::trackNullOrUndefValue(ErrorNode,
ArgEDeref,
if (Name.empty())
return;
- const Expr *Arg = 0;
+ const Expr *Arg = nullptr;
unsigned ArgNum;
if (Name.equals("CFArrayCreate") || Name.equals("CFSetCreate")) {
: II(ii), S(s) {}
ObjCSummaryKey(const ObjCInterfaceDecl *d, Selector s)
- : II(d ? d->getIdentifier() : 0), S(s) {}
+ : II(d ? d->getIdentifier() : nullptr), S(s) {}
ObjCSummaryKey(Selector s)
- : II(0), S(s) {}
+ : II(nullptr), S(s) {}
IdentifierInfo *getIdentifier() const { return II; }
Selector getSelector() const { return S; }
if (I != M.end())
return I->second;
if (!D)
- return NULL;
+ return nullptr;
// Walk the super chain. If we find a hit with a parent, we'll end
// up returning that summary. We actually allow that key (null,S), as
break;
if (!C)
- return NULL;
+ return nullptr;
}
// Cache the summary with original key to make the next lookup faster
if (I == M.end())
I = M.find(ObjCSummaryKey(S));
- return I == M.end() ? NULL : I->second;
+ return I == M.end() ? nullptr : I->second;
}
const RetainSummary *& operator[](ObjCSummaryKey K) {
}
const RetainSummary *getSummary(const CallEvent &Call,
- ProgramStateRef State = 0);
+ ProgramStateRef State = nullptr);
const RetainSummary *getFunctionSummary(const FunctionDecl *FD);
return I->second;
// No summary? Generate one.
- const RetainSummary *S = 0;
+ const RetainSummary *S = nullptr;
bool AllowAnnotations = true;
do {
const RetainSummary *
RetainSummaryManager::getInstanceMethodSummary(const ObjCMethodCall &Msg,
ProgramStateRef State) {
- const ObjCInterfaceDecl *ReceiverClass = 0;
+ const ObjCInterfaceDecl *ReceiverClass = nullptr;
// We do better tracking of the type of the object than the core ExprEngine.
// See if we have its type in our private state.
void CFRefReport::addGCModeDescription(const LangOptions &LOpts,
bool GCEnabled) {
- const char *GCModeDescription = 0;
+ const char *GCModeDescription = nullptr;
switch (LOpts.getGC()) {
case LangOptions::GCOnly:
// FIXME: We will eventually need to handle non-statement-based events
// (__attribute__((cleanup))).
if (!N->getLocation().getAs<StmtPoint>())
- return NULL;
+ return nullptr;
// Check if the type state has changed.
ProgramStateRef PrevSt = PrevN->getState();
const LocationContext *LCtx = N->getLocationContext();
const RefVal* CurrT = getRefBinding(CurrSt, Sym);
- if (!CurrT) return NULL;
+ if (!CurrT) return nullptr;
const RefVal &CurrV = *CurrT;
const RefVal *PrevT = getRefBinding(PrevSt, Sym);
if (isNumericLiteralExpression(BL->getSubExpr()))
os << "NSNumber literal is an object with a +0 retain count";
else {
- const ObjCInterfaceDecl *BoxClass = 0;
+ const ObjCInterfaceDecl *BoxClass = nullptr;
if (const ObjCMethodDecl *Method = BL->getBoxingMethod())
BoxClass = Method->getClassInterface();
if (PrevV.getCount() == CurrV.getCount()) {
// Did an autorelease message get sent?
if (PrevV.getAutoreleaseCount() == CurrV.getAutoreleaseCount())
- return 0;
+ return nullptr;
assert(PrevV.getAutoreleaseCount() < CurrV.getAutoreleaseCount());
os << "Object autoreleased";
case RefVal::ReturnedOwned:
// Autoreleases can be applied after marking a node ReturnedOwned.
if (CurrV.getAutoreleaseCount())
- return NULL;
+ return nullptr;
os << "Object returned to caller as an owning reference (single "
"retain count transferred to caller)";
break;
default:
- return NULL;
+ return nullptr;
}
// Emit any remaining diagnostics for the argument effects (if any).
} while (0);
if (os.str().empty())
- return 0; // We have nothing to say!
+ return nullptr; // We have nothing to say!
const Stmt *S = N->getLocation().castAs<StmtPoint>().getStmt();
PathDiagnosticLocation Pos(S, BRC.getSourceManager(),
SymbolRef Sym) {
const ExplodedNode *AllocationNode = N;
const ExplodedNode *AllocationNodeInCurrentContext = N;
- const MemRegion* FirstBinding = 0;
+ const MemRegion *FirstBinding = nullptr;
const LocationContext *LeakContext = N->getLocationContext();
// The location context of the init method called on the leaked object, if
// available.
- const LocationContext *InitMethodContext = 0;
+ const LocationContext *InitMethodContext = nullptr;
while (N) {
ProgramStateRef St = N->getState();
}
}
- N = N->pred_empty() ? NULL : *(N->pred_begin());
+ N = N->pred_empty() ? nullptr : *(N->pred_begin());
}
// If we are reporting a leak of the object that was allocated with alloc,
// mark its init method as interesting.
- const LocationContext *InterestingMethodContext = 0;
+ const LocationContext *InterestingMethodContext = nullptr;
if (InitMethodContext) {
const ProgramPoint AllocPP = AllocationNode->getLocation();
if (Optional<StmtPoint> SP = AllocPP.getAs<StmtPoint>())
// do not report the binding.
assert(N && "Could not find allocation node");
if (N->getLocationContext() != LeakContext) {
- FirstBinding = 0;
+ FirstBinding = nullptr;
}
return AllocationInfo(AllocationNodeInCurrentContext,
// Note that this is *not* the trimmed graph; we are guaranteed, however,
// that all ancestor nodes that represent the allocation site have the
// same SourceLocation.
- const ExplodedNode *AllocNode = 0;
+ const ExplodedNode *AllocNode = nullptr;
const SourceManager& SMgr = Ctx.getSourceManager();
ExplodedNode *processLeaks(ProgramStateRef state,
SmallVectorImpl<SymbolRef> &Leaked,
CheckerContext &Ctx,
- ExplodedNode *Pred = 0) const;
+ ExplodedNode *Pred = nullptr) const;
};
} // end anonymous namespace
// Evaluate the effect of the arguments.
RefVal::Kind hasErr = (RefVal::Kind) 0;
SourceRange ErrorRange;
- SymbolRef ErrorSym = 0;
+ SymbolRef ErrorSym = nullptr;
for (unsigned idx = 0, e = CallOrMsg.getNumArgs(); idx != e; ++idx) {
SVal V = CallOrMsg.getArgSVal(idx);
if (RetVal.isUnknown()) {
// If the receiver is unknown, conjure a return value.
SValBuilder &SVB = C.getSValBuilder();
- RetVal = SVB.conjureSymbolVal(0, CE, LCtx, ResultTy, C.blockCount());
+ RetVal = SVB.conjureSymbolVal(nullptr, CE, LCtx, ResultTy, C.blockCount());
}
state = state->BindExpr(CE, LCtx, RetVal, false);
if (const MemRegion *ArgRegion = RetVal.getAsRegion()) {
// Save the refcount status of the argument.
SymbolRef Sym = RetVal.getAsLocSymbol();
- const RefVal *Binding = 0;
+ const RefVal *Binding = nullptr;
if (Sym)
Binding = getRefBinding(state, Sym);
Ctx.emitReport(report);
}
- return 0;
+ return nullptr;
}
ProgramStateRef
}
for (RefBindingsTy::iterator I = B.begin(), E = B.end(); I != E; ++I) {
- state = handleAutoreleaseCounts(state, Pred, /*Tag=*/0, Ctx,
+ state = handleAutoreleaseCounts(state, Pred, /*Tag=*/nullptr, Ctx,
I->first, I->second);
if (!state)
return;
}
static void emitBug(CheckerContext &C, BuiltinBug &BT, const Expr *RetE,
- const Expr *TrackingE = 0) {
+ const Expr *TrackingE = nullptr) {
ExplodedNode *N = C.generateSink();
if (!N)
return;
};
} // end anonymous namespace
-
-SimpleStreamChecker::SimpleStreamChecker() : IIfopen(0), IIfclose(0) {
+SimpleStreamChecker::SimpleStreamChecker()
+ : IIfopen(nullptr), IIfclose(nullptr) {
// Initialize the bug types.
DoubleCloseBugType.reset(
new BugType(this, "Double fclose", "Unix Stream API Error"));
public:
StreamChecker()
- : II_fopen(0), II_tmpfile(0) ,II_fclose(0), II_fread(0), II_fwrite(0),
- II_fseek(0), II_ftell(0), II_rewind(0), II_fgetpos(0), II_fsetpos(0),
- II_clearerr(0), II_feof(0), II_ferror(0), II_fileno(0) {}
+ : II_fopen(nullptr), II_tmpfile(nullptr), II_fclose(nullptr),
+ II_fread(nullptr), II_fwrite(nullptr), II_fseek(nullptr),
+ II_ftell(nullptr), II_rewind(nullptr), II_fgetpos(nullptr),
+ II_fsetpos(nullptr), II_clearerr(nullptr), II_feof(nullptr),
+ II_ferror(nullptr), II_fileno(nullptr) {}
bool evalCall(const CallExpr *CE, CheckerContext &C) const;
void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const;
ProgramStateRef state = C.getState();
SValBuilder &svalBuilder = C.getSValBuilder();
const LocationContext *LCtx = C.getPredecessor()->getLocationContext();
- DefinedSVal RetVal = svalBuilder.conjureSymbolVal(0, CE, LCtx, C.blockCount())
+ DefinedSVal RetVal = svalBuilder.conjureSymbolVal(nullptr, CE, LCtx,
+ C.blockCount())
.castAs<DefinedSVal>();
state = state->BindExpr(CE, C.getLocationContext(), RetVal);
CheckerContext &C) const {
Optional<DefinedSVal> DV = SV.getAs<DefinedSVal>();
if (!DV)
- return 0;
+ return nullptr;
ConstraintManager &CM = C.getConstraintManager();
ProgramStateRef stateNotNull, stateNull;
BugReport *R =new BugReport(*BT_nullfp, BT_nullfp->getDescription(), N);
C.emitReport(R);
}
- return 0;
+ return nullptr;
}
return stateNotNull;
}
BT_doubleclose->getDescription(), N);
C.emitReport(R);
}
- return NULL;
+ return nullptr;
}
// Close the File Descriptor.
void CallDumper::checkPreCall(const CallEvent &Call, CheckerContext &C) const {
unsigned Indentation = 0;
for (const LocationContext *LC = C.getLocationContext()->getParent();
- LC != 0; LC = LC->getParent())
+ LC != nullptr; LC = LC->getParent())
++Indentation;
// It is mildly evil to print directly to llvm::outs() rather than emitting
unsigned Indentation = 0;
for (const LocationContext *LC = C.getLocationContext()->getParent();
- LC != 0; LC = LC->getParent())
+ LC != nullptr; LC = LC->getParent())
++Indentation;
// It is mildly evil to print directly to llvm::outs() rather than emitting
const Expr *FindExpr(const Expr *Ex) {
if (!MatchesCriteria(Ex))
- return 0;
+ return nullptr;
for (Stmt::const_child_iterator I = Ex->child_begin(),
E = Ex->child_end();I!=E;++I)
return BR;
}
- return NULL;
+ return nullptr;
}
void
SmallString<256> sbuf;
llvm::raw_svector_ostream OS(sbuf);
- const Expr *Ex = NULL;
+ const Expr *Ex = nullptr;
bool isLeft = true;
if (state->getSVal(B->getLHS(), LCtx).isUndef()) {
BT.reset(new BuiltinBug(this, str));
// Generate a report for this bug.
- const Expr *ex = 0;
+ const Expr *ex = nullptr;
while (StoreE) {
if (const BinaryOperator *B = dyn_cast<BinaryOperator>(StoreE)) {
// Check if the allocation size is 0.
ProgramStateRef state = C.getState();
- ProgramStateRef trueState = NULL, falseState = NULL;
+ ProgramStateRef trueState = nullptr, falseState = nullptr;
const Expr *arg = CE->getArg(sizeArg);
SVal argVal = state->getSVal(arg, C.getLocationContext());
return;
ProgramStateRef state = C.getState();
- ProgramStateRef trueState = NULL, falseState = NULL;
+ ProgramStateRef trueState = nullptr, falseState = nullptr;
unsigned int i;
for (i = 0; i < nArgs; i++) {
.Case("reallocf", &UnixAPIChecker::CheckReallocfZero)
.Cases("alloca", "__builtin_alloca", &UnixAPIChecker::CheckAllocaZero)
.Case("valloc", &UnixAPIChecker::CheckVallocZero)
- .Default(NULL);
+ .Default(nullptr);
if (SC)
(this->*SC)(C, CE);
if (Eng.hasWorkRemaining())
return;
- const Decl *D = 0;
- CFG *C = 0;
- ParentMap *PM = 0;
- const LocationContext *LC = 0;
+ const Decl *D = nullptr;
+ CFG *C = nullptr;
+ ParentMap *PM = nullptr;
+ const LocationContext *LC = nullptr;
// Iterate over ExplodedGraph
for (ExplodedGraph::node_iterator I = G.nodes_begin(), E = G.nodes_end();
I != E; ++I) {
if (const Stmt *S = CB->getTerminator())
return S;
else
- return 0;
+ return nullptr;
}
// Determines if the path to this CFGBlock contained an element that infers this
// Returns true if the given CFGBlock is empty
bool UnreachableCodeChecker::isEmptyCFGBlock(const CFGBlock *CB) {
- return CB->getLabel() == 0 // No labels
+ return CB->getLabel() == nullptr // No labels
&& CB->size() == 0 // No statements
&& !CB->getTerminator(); // No terminator
}
// Check if the size is tainted.
if (state->isTainted(sizeV)) {
- reportBug(VLA_Tainted, SE, 0, C);
+ reportBug(VLA_Tainted, SE, nullptr, C);
return;
}
public:
WalkAST(const CheckerBase *checker, BugReporter &br,
AnalysisDeclContext *ac)
- : Checker(checker), BR(br), AC(ac), visitingCallExpr(0) {}
+ : Checker(checker), BR(br), AC(ac), visitingCallExpr(nullptr) {}
bool hasWork() const { return !WList.empty(); }
// Use the User Mode to set the default IPA value.
// Note, we have to add the string to the Config map for the ConfigDumper
// checker to function properly.
- const char *DefaultIPA = 0;
+ const char *DefaultIPA = nullptr;
UserModeKind HighLevelMode = getUserMode();
if (HighLevelMode == UMK_Shallow)
DefaultIPA = "inlining";
// FIXME: Expand these checks to include all undefined behavior.
if (V2.isSigned() && V2.isNegative())
- return NULL;
+ return nullptr;
uint64_t Amt = V2.getZExtValue();
if (Amt >= V1.getBitWidth())
- return NULL;
+ return nullptr;
return &getValue( V1.operator<<( (unsigned) Amt ));
}
// FIXME: Expand these checks to include all undefined behavior.
if (V2.isSigned() && V2.isNegative())
- return NULL;
+ return nullptr;
uint64_t Amt = V2.getZExtValue();
if (Amt >= V1.getBitWidth())
- return NULL;
+ return nullptr;
return &getValue( V1.operator>>( (unsigned) Amt ));
}
if (const Stmt *S = PathDiagnosticLocation::getStmt(N))
return S;
- return 0;
+ return nullptr;
}
static inline const Stmt*
const void *tagLesser = TrackConstraintBRVisitor::getTag();
if (X->getLocation() != Y->getLocation())
- return 0;
-
+ return nullptr;
+
if (X->getTag() == tagPreferred && Y->getTag() == tagLesser)
return X;
if (Y->getTag() == tagPreferred && X->getTag() == tagLesser)
return Y;
-
- return 0;
+
+ return nullptr;
}
/// An optimization pass over PathPieces that removes redundant diagnostics
/// Recursively scan through a path and make sure that all call pieces have
/// valid locations.
-static void adjustCallLocations(PathPieces &Pieces,
- PathDiagnosticLocation *LastCallLocation = 0) {
+static void
+adjustCallLocations(PathPieces &Pieces,
+ PathDiagnosticLocation *LastCallLocation = nullptr) {
for (PathPieces::iterator I = Pieces.begin(), E = Pieces.end(); I != E; ++I) {
PathDiagnosticCallPiece *Call = dyn_cast<PathDiagnosticCallPiece>(*I);
const Stmt *Parent = PM.getParentIgnoreParens(S);
if (!Parent)
- return 0;
+ return nullptr;
switch (Parent->getStmtClass()) {
case Stmt::ForStmtClass:
break;
}
- return 0;
+ return nullptr;
}
static PathDiagnosticLocation
SourceManager& SMgr = PDB.getSourceManager();
const LocationContext *LC = PDB.LC;
const ExplodedNode *NextNode = N->pred_empty()
- ? NULL : *(N->pred_begin());
+ ? nullptr : *(N->pred_begin());
StackDiagVector CallStack;
}
N = N->getFirstPred();
}
- return 0;
+ return nullptr;
}
static bool isInLoopBody(ParentMap &PM, const Stmt *S, const Stmt *Term) {
- const Stmt *LoopBody = 0;
+ const Stmt *LoopBody = nullptr;
switch (Term->getStmtClass()) {
case Stmt::CXXForRangeStmtClass: {
const CXXForRangeStmt *FR = cast<CXXForRangeStmt>(Term);
StackDiagVector CallStack;
InterestingExprs IE;
- const ExplodedNode *NextNode = N->pred_empty() ? NULL : *(N->pred_begin());
+ const ExplodedNode *NextNode = N->pred_empty() ? nullptr : *(N->pred_begin());
while (NextNode) {
N = NextNode;
NextNode = N->getFirstPred();
// Are we jumping to the head of a loop? Add a special diagnostic.
if (const Stmt *Loop = BE->getSrc()->getLoopTarget()) {
PathDiagnosticLocation L(Loop, SM, PDB.LC);
- const CompoundStmt *CS = NULL;
+ const CompoundStmt *CS = nullptr;
if (const ForStmt *FS = dyn_cast<ForStmt>(Loop))
CS = dyn_cast<CompoundStmt>(FS->getBody());
// reset the mapping from active to location context.
assert(PD.getActivePath().size() == 1 &&
PD.getActivePath().front() == C);
- LCM[&PD.getActivePath()] = 0;
+ LCM[&PD.getActivePath()] = nullptr;
// Record the location context mapping for the path within
// the call.
- assert(LCM[&C->path] == 0 ||
+ assert(LCM[&C->path] == nullptr ||
LCM[&C->path] == CE->getCalleeContext());
LCM[&C->path] = CE->getCalleeContext();
// Are we jumping to the head of a loop? Add a special diagnostic.
if (const Stmt *Loop = BE->getSrc()->getLoopTarget()) {
PathDiagnosticLocation L(Loop, SM, PDB.LC);
- const Stmt *Body = NULL;
+ const Stmt *Body = nullptr;
if (const ForStmt *FS = dyn_cast<ForStmt>(Loop))
Body = FS->getBody();
bool IsInLoopBody =
isInLoopBody(PM, getStmtBeforeCond(PM, TermCond, N), Term);
- const char *str = 0;
+ const char *str = nullptr;
if (isJumpToFalseBranch(&*BE)) {
if (!IsInLoopBody) {
static const Stmt *getLocStmt(PathDiagnosticLocation L) {
if (!L.isValid())
- return 0;
+ return nullptr;
return L.asStmt();
}
static const Stmt *getStmtParent(const Stmt *S, const ParentMap &PM) {
if (!S)
- return 0;
+ return nullptr;
while (true) {
S = PM.getParentIgnoreParens(S);
SmallVector<PathDiagnosticLocation, 4> SrcContexts;
PathDiagnosticLocation NextSrcContext = SrcLoc;
- const Stmt *InnerStmt = 0;
+ const Stmt *InnerStmt = nullptr;
while (NextSrcContext.isValid() && NextSrcContext.asStmt() != InnerStmt) {
SrcContexts.push_back(NextSrcContext);
InnerStmt = NextSrcContext.asStmt();
if (NextI == E)
break;
- PathDiagnosticControlFlowPiece *PieceNextI = 0;
+ PathDiagnosticControlFlowPiece *PieceNextI = nullptr;
while (true) {
if (NextI == E)
const ExplodedNode *N = getErrorNode();
if (!N)
- return 0;
-
+ return nullptr;
+
const LocationContext *LC = N->getLocationContext();
return LC->getCurrentStackFrame()->getDecl();
}
const Stmt *BugReport::getStmt() const {
if (!ErrorNode)
- return 0;
+ return nullptr;
ProgramPoint ProgP = ErrorNode->getLocation();
- const Stmt *S = NULL;
+ const Stmt *S = nullptr;
if (Optional<BlockEntrance> BE = ProgP.getAs<BlockEntrance>()) {
CFGBlock &Exit = ProgP.getLocationContext()->getCFG()->getExit();
// Now walk from the error node up the BFS path, always taking the
// predeccessor with the lowest number.
- ExplodedNode *Succ = 0;
+ ExplodedNode *Succ = nullptr;
while (true) {
// Create the equivalent node in the new graph with the same state
// and location.
} else {
// Keep the errorNodes list in sync with the bugReports list.
HasInvalid = true;
- errorNodes.push_back(0);
+ errorNodes.push_back(nullptr);
}
}
// DFS traversal of the ExplodedGraph to find a non-sink node. We could write
// this as a recursive function, but we don't want to risk blowing out the
// stack for very long paths.
- BugReport *exampleReport = 0;
+ BugReport *exampleReport = nullptr;
for (; I != E; ++I) {
const ExplodedNode *errorNode = I->getErrorNode();
// a[0], p->f, *p
const Expr *E = dyn_cast<Expr>(S);
if (!E)
- return 0;
+ return nullptr;
E = E->IgnoreParenCasts();
while (true) {
break;
}
- return NULL;
+ return nullptr;
}
const Stmt *bugreporter::GetDenomExpr(const ExplodedNode *N) {
const Stmt *S = N->getLocationAs<PreStmt>()->getStmt();
if (const BinaryOperator *BE = dyn_cast<BinaryOperator>(S))
return BE->getRHS();
- return NULL;
+ return nullptr;
}
const Stmt *bugreporter::GetRetValExpr(const ExplodedNode *N) {
const Stmt *S = N->getLocationAs<PostStmt>()->getStmt();
if (const ReturnStmt *RS = dyn_cast<ReturnStmt>(S))
return RS->getRetValue();
- return NULL;
+ return nullptr;
}
//===----------------------------------------------------------------------===//
BugReporterVisitor::getEndPath(BugReporterContext &BRC,
const ExplodedNode *EndPathNode,
BugReport &BR) {
- return 0;
+ return nullptr;
}
PathDiagnosticPiece*
BugReport &BR) {
// Only print a message at the interesting return statement.
if (N->getLocationContext() != StackFrame)
- return 0;
+ return nullptr;
Optional<StmtPoint> SP = N->getLocationAs<StmtPoint>();
if (!SP)
- return 0;
+ return nullptr;
const ReturnStmt *Ret = dyn_cast<ReturnStmt>(SP->getStmt());
if (!Ret)
- return 0;
+ return nullptr;
// Okay, we're at the right return statement, but do we have the return
// value available?
ProgramStateRef State = N->getState();
SVal V = State->getSVal(Ret, StackFrame);
if (V.isUnknownOrUndef())
- return 0;
+ return nullptr;
// Don't print any more notes after this one.
Mode = Satisfied;
// Ignore aggregate rvalues.
if (V.getAs<nonloc::LazyCompoundVal>() ||
V.getAs<nonloc::CompoundVal>())
- return 0;
+ return nullptr;
RetE = RetE->IgnoreParenCasts();
BR.markInteresting(V);
ReturnVisitor::addVisitorIfNecessary(N, RetE, BR,
EnableNullFPSuppression);
- return 0;
+ return nullptr;
}
// If we're returning 0, we should track where that 0 came from.
// Are we at the entry node for this call?
Optional<CallEnter> CE = N->getLocationAs<CallEnter>();
if (!CE)
- return 0;
+ return nullptr;
if (CE->getCalleeContext() != StackFrame)
- return 0;
+ return nullptr;
Mode = Satisfied;
// (We will still look at the other arguments, though.)
}
- return 0;
+ return nullptr;
}
PathDiagnosticPiece *VisitNode(const ExplodedNode *N,
case MaybeUnsuppress:
return visitNodeMaybeUnsuppress(N, PrevN, BRC, BR);
case Satisfied:
- return 0;
+ return nullptr;
}
llvm_unreachable("Invalid visit mode!");
BugReport &BR) override {
if (EnableNullFPSuppression)
BR.markInvalid(ReturnVisitor::getTag(), StackFrame);
- return 0;
+ return nullptr;
}
};
} // end anonymous namespace
BugReport &BR) {
if (Satisfied)
- return NULL;
+ return nullptr;
- const ExplodedNode *StoreSite = 0;
- const Expr *InitE = 0;
+ const ExplodedNode *StoreSite = nullptr;
+ const Expr *InitE = nullptr;
bool IsParam = false;
// First see if we reached the declaration of the region.
// the same binding was re-assigned here.
if (!StoreSite) {
if (Succ->getState()->getSVal(R) != V)
- return NULL;
+ return nullptr;
if (Pred->getState()->getSVal(R) == V) {
Optional<PostStore> PS = Succ->getLocationAs<PostStore>();
if (!PS || PS->getLocationValue() != R)
- return NULL;
+ return nullptr;
}
StoreSite = Succ;
}
if (!StoreSite)
- return NULL;
+ return nullptr;
Satisfied = true;
// If we have an expression that provided the value, try to track where it
if (Optional<PostStmt> PS = StoreSite->getLocationAs<PostStmt>()) {
const Stmt *S = PS->getStmt();
- const char *action = 0;
+ const char *action = nullptr;
const DeclStmt *DS = dyn_cast<DeclStmt>(S);
const VarRegion *VR = dyn_cast<VarRegion>(R);
L = PathDiagnosticLocation::create(P, BRC.getSourceManager());
if (!L.isValid() || !L.asLocation().isValid())
- return NULL;
+ return nullptr;
return new PathDiagnosticEventPiece(L, os.str());
}
BugReporterContext &BRC,
BugReport &BR) {
if (IsSatisfied)
- return NULL;
+ return nullptr;
// Start tracking after we see the first state in which the value is
// constrained.
if (!isUnderconstrained(N))
IsTrackingTurnedOn = true;
if (!IsTrackingTurnedOn)
- return 0;
+ return nullptr;
// Check if in the previous state it was feasible for this constraint
// to *not* be true.
}
if (os.str().empty())
- return NULL;
+ return nullptr;
// Construct a new PathDiagnosticPiece.
ProgramPoint P = N->getLocation();
PathDiagnosticLocation L =
PathDiagnosticLocation::create(P, BRC.getSourceManager());
if (!L.isValid())
- return NULL;
-
+ return nullptr;
+
PathDiagnosticEventPiece *X = new PathDiagnosticEventPiece(L, os.str());
X->setTag(getTag());
return X;
}
- return NULL;
+ return nullptr;
}
SuppressInlineDefensiveChecksVisitor::
BugReporterContext &BRC,
BugReport &BR) {
if (IsSatisfied)
- return 0;
+ return nullptr;
// Start tracking after we see the first state in which the value is null.
if (!IsTrackingTurnedOn)
if (Succ->getState()->isNull(V).isConstrainedTrue())
IsTrackingTurnedOn = true;
if (!IsTrackingTurnedOn)
- return 0;
+ return nullptr;
// Check if in the previous state it was feasible for this value
// to *not* be null.
if (CurLC != ReportLC && !CurLC->isParentOf(ReportLC))
BR.markInvalid("Suppress IDC", CurLC);
}
- return 0;
+ return nullptr;
}
static const MemRegion *getLocationRegionIfReference(const Expr *E,
if (const DeclRefExpr *DR = dyn_cast<DeclRefExpr>(E)) {
if (const VarDecl *VD = dyn_cast<VarDecl>(DR->getDecl())) {
if (!VD->getType()->isReferenceType())
- return 0;
+ return nullptr;
ProgramStateManager &StateMgr = N->getState()->getStateManager();
MemRegionManager &MRMgr = StateMgr.getRegionManager();
return MRMgr.getVarRegion(VD, N->getLocationContext());
// Wrapper w = { *(int *)0 };
// w.ref = 1;
- return 0;
+ return nullptr;
}
static const Expr *peelOffOuterExpr(const Expr *Ex,
S = PeeledEx;
}
- const Expr *Inner = 0;
+ const Expr *Inner = nullptr;
if (const Expr *Ex = dyn_cast<Expr>(S)) {
Ex = Ex->IgnoreParenCasts();
if (ExplodedGraph::isInterestingLValueExpr(Ex) || CallEvent::isCallStmt(Ex))
// See if the expression we're interested refers to a variable.
// If so, we can track both its contents and constraints on its value.
if (Inner && ExplodedGraph::isInterestingLValueExpr(Inner)) {
- const MemRegion *R = 0;
+ const MemRegion *R = nullptr;
// Find the ExplodedNode where the lvalue (the value of 'Ex')
// was computed. We need this for getting the location value.
const ExplodedNode *N) {
const ObjCMessageExpr *ME = dyn_cast<ObjCMessageExpr>(S);
if (!ME)
- return 0;
+ return nullptr;
if (const Expr *Receiver = ME->getInstanceReceiver()) {
ProgramStateRef state = N->getState();
SVal V = state->getSVal(Receiver, N->getLocationContext());
if (state->isNull(V).isConstrainedTrue())
return Receiver;
}
- return 0;
+ return nullptr;
}
PathDiagnosticPiece *NilReceiverBRVisitor::VisitNode(const ExplodedNode *N,
BugReport &BR) {
Optional<PreStmt> P = N->getLocationAs<PreStmt>();
if (!P)
- return 0;
+ return nullptr;
const Stmt *S = P->getStmt();
const Expr *Receiver = getNilReceiver(S, N);
if (!Receiver)
- return 0;
+ return nullptr;
llvm::SmallString<256> Buf;
llvm::raw_svector_ostream OS(Buf);
// were generated by the analyzer engine proper, not checkers.
if (CurrentState->getGDM().getRoot() ==
PrevState->getGDM().getRoot())
- return 0;
-
+ return nullptr;
+
// If an assumption was made on a branch, it should be caught
// here by looking at the state transition.
if (Optional<BlockEdge> BE = progPoint.getAs<BlockEdge>()) {
const CFGBlock *srcBlk = BE->getSrc();
if (const Stmt *term = srcBlk->getTerminator())
return VisitTerminator(term, N, srcBlk, BE->getDst(), BR, BRC);
- return 0;
+ return nullptr;
}
if (Optional<PostStmt> PS = progPoint.getAs<PostStmt>()) {
if (tag == tags.second)
return VisitTrueTest(cast<Expr>(PS->getStmt()), false,
BRC, BR, N);
-
- return 0;
+
+ return nullptr;
}
-
- return 0;
+
+ return nullptr;
}
PathDiagnosticPiece *
const CFGBlock *dstBlk,
BugReport &R,
BugReporterContext &BRC) {
- const Expr *Cond = 0;
-
+ const Expr *Cond = nullptr;
+
switch (Term->getStmtClass()) {
default:
- return 0;
+ return nullptr;
case Stmt::IfStmtClass:
Cond = cast<IfStmt>(Term)->getCond();
break;
Ex = Ex->IgnoreParenCasts();
switch (Ex->getStmtClass()) {
default:
- return 0;
+ return nullptr;
case Stmt::BinaryOperatorClass:
return VisitTrueTest(Cond, cast<BinaryOperator>(Ex), tookTrue, BRC,
R, N);
Ex = UO->getSubExpr();
continue;
}
- return 0;
+ return nullptr;
}
}
}
// both the LHS and RHS.
if (LhsString.empty() || RhsString.empty() ||
!BinaryOperator::isComparisonOp(Op))
- return 0;
-
+ return nullptr;
+
// Should we invert the strings if the LHS is not a variable name?
SmallString<256> buf;
llvm::raw_svector_ostream Out(buf);
case BO_LE: Op = BO_GT; break;
case BO_GE: Op = BO_LT; break;
default:
- return 0;
+ return nullptr;
}
switch (Op) {
else if (Ty->isIntegralOrEnumerationType())
Out << (tookTrue ? "non-zero" : "zero");
else
- return 0;
+ return nullptr;
const LocationContext *LCtx = N->getLocationContext();
PathDiagnosticLocation Loc(CondVarExpr, BRC.getSourceManager(), LCtx);
const VarDecl *VD = dyn_cast<VarDecl>(DR->getDecl());
if (!VD)
- return 0;
-
+ return nullptr;
+
SmallString<256> Buf;
llvm::raw_svector_ostream Out(Buf);
else if (VDTy->isScalarType())
Out << (tookTrue ? "not equal to 0" : "0");
else
- return 0;
-
+ return nullptr;
+
const LocationContext *LCtx = N->getLocationContext();
PathDiagnosticLocation Loc(Cond, BRC.getSourceManager(), LCtx);
PathDiagnosticEventPiece *event =
// Note that this will not help for any other data structure libraries, like
// TR1, Boost, or llvm/ADT.
if (Options.shouldSuppressFromCXXStandardLibrary()) {
- BR.markInvalid(getTag(), 0);
- return 0;
+ BR.markInvalid(getTag(), nullptr);
+ return nullptr;
} else {
// If the the complete 'std' suppression is not enabled, suppress reports
if (const CXXMethodDecl *MD = dyn_cast<CXXMethodDecl>(D)) {
const CXXRecordDecl *CD = MD->getParent();
if (CD->getName() == "list") {
- BR.markInvalid(getTag(), 0);
- return 0;
+ BR.markInvalid(getTag(), nullptr);
+ return nullptr;
}
}
const CXXRecordDecl *CD = MD->getParent();
if (CD->getName() == "basic_string") {
- BR.markInvalid(getTag(), 0);
- return 0;
+ BR.markInvalid(getTag(), nullptr);
+ return nullptr;
}
}
}
while (Loc.isMacroID()) {
Loc = Loc.getSpellingLoc();
if (SM.getFilename(Loc).endswith("sys/queue.h")) {
- BR.markInvalid(getTag(), 0);
- return 0;
+ BR.markInvalid(getTag(), nullptr);
+ return nullptr;
}
}
- return 0;
+ return nullptr;
}
PathDiagnosticPiece *
// We are only interested in visiting CallEnter nodes.
Optional<CallEnter> CEnter = ProgLoc.getAs<CallEnter>();
if (!CEnter)
- return 0;
+ return nullptr;
// Check if one of the arguments is the region the visitor is tracking.
CallEventManager &CEMgr = BRC.getStateManager().getCallEventManager();
SVal BoundVal = State->getSVal(R);
if (BoundVal.isUndef() || BoundVal.isZeroConstant()) {
BR.markInteresting(CEnter->getCalleeContext());
- return 0;
+ return nullptr;
}
}
- return 0;
+ return nullptr;
}
return Result->invalidateRegions(ValuesToInvalidate, getOriginExpr(),
BlockCount, getLocationContext(),
/*CausedByPointerEscape*/ true,
- /*Symbols=*/0, this, &ETraits);
+ /*Symbols=*/nullptr, this, &ETraits);
}
ProgramPoint CallEvent::getProgramPoint(bool IsPreVisit,
void CallEvent::dump(raw_ostream &Out) const {
ASTContext &Ctx = getState()->getStateManager().getContext();
if (const Expr *E = getOriginExpr()) {
- E->printPretty(Out, 0, Ctx.getPrintingPolicy());
+ E->printPretty(Out, nullptr, Ctx.getPrintingPolicy());
Out << "\n";
return;
}
// that ExprEngine can decide what to do with it.
if (DynType.canBeASubClass())
return RuntimeDefinition(Definition, R->StripCasts());
- return RuntimeDefinition(Definition, /*DispatchRegion=*/0);
+ return RuntimeDefinition(Definition, /*DispatchRegion=*/nullptr);
}
void CXXInstanceCall::getInitialStackFrameContents(
ArrayRef<ParmVarDecl*> BlockCall::parameters() const {
const BlockDecl *D = getDecl();
if (!D)
- return 0;
+ return nullptr;
return D->parameters();
}
typedef llvm::PointerIntPair<const PseudoObjectExpr *, 2> ObjCMessageDataTy;
const PseudoObjectExpr *ObjCMethodCall::getContainingPseudoObjectExpr() const {
- assert(Data != 0 && "Lazy lookup not yet performed.");
+ assert(Data && "Lazy lookup not yet performed.");
assert(getMessageKind() != OCM_Message && "Explicit message send.");
return ObjCMessageDataTy::getFromOpaqueValue(Data).getPointer();
}
ObjCMessageKind ObjCMethodCall::getMessageKind() const {
- if (Data == 0) {
+ if (!Data) {
// Find the parent, ignoring implicit casts.
ParentMap &PM = getLocationContext()->getParentMap();
}
const_cast<ObjCMethodCall *>(this)->Data
- = ObjCMessageDataTy(0, 1).getOpaqueValue();
+ = ObjCMessageDataTy(nullptr, 1).getOpaqueValue();
assert(getMessageKind() == OCM_Message);
return OCM_Message;
}
// Find the first declaration in the class hierarchy that declares
// the selector.
- ObjCMethodDecl *D = 0;
+ ObjCMethodDecl *D = nullptr;
while (true) {
D = IDecl->lookupMethod(Sel, true);
if (E->isInstanceMessage()) {
// Find the the receiver type.
- const ObjCObjectPointerType *ReceiverT = 0;
+ const ObjCObjectPointerType *ReceiverT = nullptr;
bool CanBeSubClassed = false;
QualType SupersType = E->getSuperType();
- const MemRegion *Receiver = 0;
+ const MemRegion *Receiver = nullptr;
if (!SupersType.isNull()) {
// Super always means the type of immediate predecessor to the method
if (CanBeSubClassed)
return RuntimeDefinition(MD, Receiver);
else
- return RuntimeDefinition(MD, 0);
+ return RuntimeDefinition(MD, nullptr);
}
} else {
assert(D);
unsigned DeclKind = D->getKind();
- CachedDeclCheckers *checkers = 0;
+ CachedDeclCheckers *checkers = nullptr;
CachedDeclCheckersMapTy::iterator CCI = CachedDeclCheckersMap.find(DeclKind);
if (CCI != CachedDeclCheckersMap.end()) {
checkers = &(CCI->second);
const ExplodedNodeSet *PrevSet = &Src;
for (; I != E; ++I) {
- ExplodedNodeSet *CurrSet = 0;
+ ExplodedNodeSet *CurrSet = nullptr;
if (I+1 == E)
CurrSet = &Dst;
else {
// If any checker declares the state infeasible (or if it starts that way),
// bail out.
if (!state)
- return NULL;
+ return nullptr;
state = RegionChangesCheckers[i].CheckFn(state, invalidated,
ExplicitRegions, Regions, Call);
}
const CallEvent *Call,
PointerEscapeKind Kind,
RegionAndSymbolInvalidationTraits *ETraits) {
- assert((Call != NULL ||
+ assert((Call != nullptr ||
(Kind != PSK_DirectEscapeOnCall &&
Kind != PSK_IndirectEscapeOnCall)) &&
"Call must not be NULL when escaping on call");
// If any checker declares the state infeasible (or if it starts that
// way), bail out.
if (!State)
- return NULL;
+ return nullptr;
State = PointerEscapeCheckers[i](State, Escaped, Call, Kind, ETraits);
}
return State;
// If any checker declares the state infeasible (or if it starts that way),
// bail out.
if (!state)
- return NULL;
+ return nullptr;
state = EvalAssumeCheckers[i](state, Cond, Assumption);
}
return state;
const llvm::StringMap<size_t> &packageSizes,
CheckerOptInfo &opt, CheckerInfoSet &collected) {
// Use a binary search to find the possible start of the package.
- CheckerRegistry::CheckerInfo packageInfo(NULL, opt.getName(), "");
+ CheckerRegistry::CheckerInfo packageInfo(nullptr, opt.getName(), "");
CheckerRegistry::CheckerInfoList::const_iterator e = checkers.end();
CheckerRegistry::CheckerInfoList::const_iterator i =
std::lower_bound(checkers.begin(), e, packageInfo, checkerNameLT);
if (!InitState)
// Generate the root.
- generateNode(StartLoc, SubEng.getInitialState(L), 0);
+ generateNode(StartLoc, SubEng.getInitialState(L), nullptr);
else
- generateNode(StartLoc, InitState, 0);
+ generateNode(StartLoc, InitState, nullptr);
}
// Check if we have a steps limit
bool isNew;
ExplodedNode *Node = G->getNode(Loc, N->getState(), false, &isNew);
Node->addPredecessor(N, *G);
- return isNew ? Node : 0;
+ return isNew ? Node : nullptr;
}
Frontier.erase(FromN);
if (!IsNew)
- return 0;
+ return nullptr;
if (!MarkAsSink)
Frontier.Add(N);
ExplodedNode *NodePred) {
// If the branch has been marked infeasible we should not generate a node.
if (!isFeasible(branch))
- return NULL;
+ return nullptr;
ProgramPoint Loc = BlockEdge(C.Block, branch ? DstT:DstF,
NodePred->getLocationContext());
Succ->addPredecessor(Pred, *Eng.G);
if (!IsNew)
- return 0;
+ return nullptr;
if (!IsSink)
Eng.WList->enqueue(Succ);
false, &IsNew);
Succ->addPredecessor(Pred, *Eng.G);
if (!IsNew)
- return 0;
+ return nullptr;
Eng.WList->enqueue(Succ);
return Succ;
// Sanity check for default blocks that are unreachable and not caught
// by earlier stages.
if (!DefaultBlock)
- return NULL;
-
+ return nullptr;
+
bool IsNew;
ExplodedNode *Succ = Eng.G->getNode(BlockEdge(Src, DefaultBlock,
Pred->getLocationContext()), St,
Succ->addPredecessor(Pred, *Eng.G);
if (!IsNew)
- return 0;
+ return nullptr;
if (!IsSink)
Eng.WList->enqueue(Succ);
EnvironmentEntry::EnvironmentEntry(const Stmt *S, const LocationContext *L)
: std::pair<const Stmt *,
const StackFrameContext *>(ignoreTransparentExprs(S),
- L ? L->getCurrentStackFrame() : 0) {}
+ L ? L->getCurrentStackFrame()
+ : nullptr) {}
SVal Environment::lookupExpr(const EnvironmentEntry &E) const {
const SVal* X = ExprBindings.lookup(E);
Out << " (" << (const void*) En.getLocationContext() << ','
<< (const void*) S << ") ";
LangOptions LO; // FIXME.
- S->printPretty(Out, 0, PrintingPolicy(LO));
+ S->printPretty(Out, nullptr, PrintingPolicy(LO));
Out << " : " << I.getData();
}
}
ExplodedNode::Auditor::~Auditor() {}
#ifndef NDEBUG
-static ExplodedNode::Auditor* NodeAuditor = 0;
+static ExplodedNode::Auditor* NodeAuditor = nullptr;
#endif
void ExplodedNode::SetAuditor(ExplodedNode::Auditor* A) {
ExplodedNode * const *ExplodedNode::NodeGroup::begin() const {
if (getFlag())
- return 0;
+ return nullptr;
const GroupStorage &Storage = reinterpret_cast<const GroupStorage &>(P);
if (Storage.isNull())
- return 0;
+ return nullptr;
if (ExplodedNodeVector *V = Storage.dyn_cast<ExplodedNodeVector *>())
return V->begin();
return Storage.getAddrOfPtr1();
ExplodedNode * const *ExplodedNode::NodeGroup::end() const {
if (getFlag())
- return 0;
+ return nullptr;
const GroupStorage &Storage = reinterpret_cast<const GroupStorage &>(P);
if (Storage.isNull())
- return 0;
+ return nullptr;
if (ExplodedNodeVector *V = Storage.dyn_cast<ExplodedNodeVector *>())
return V->end();
return Storage.getAddrOfPtr1() + 1;
bool* IsNew) {
// Profile 'State' to determine if we already have an existing node.
llvm::FoldingSetNodeID profile;
- void *InsertPos = 0;
+ void *InsertPos = nullptr;
NodeTy::Profile(profile, L, State, IsSink);
NodeTy* V = Nodes.FindNodeOrInsertPos(profile, InsertPos);
InterExplodedGraphMap *InverseMap) const{
if (Nodes.empty())
- return 0;
+ return nullptr;
typedef llvm::DenseSet<const ExplodedNode*> Pass1Ty;
Pass1Ty Pass1;
// We didn't hit a root? Return with a null pointer for the new graph.
if (WL2.empty())
- return 0;
+ return nullptr;
// Create an empty graph.
ExplodedGraph* G = MakeEmptyGraph();
// Create the corresponding node in the new graph and record the mapping
// from the old node to the new node.
- ExplodedNode *NewN = G->getNode(N->getLocation(), N->State, N->isSink(), 0);
+ ExplodedNode *NewN = G->getNode(N->getLocation(), N->State, N->isSink(),
+ nullptr);
Pass2[N] = NewN;
// Also record the reverse mapping from the new node to the old node.
this),
SymMgr(StateMgr.getSymbolManager()),
svalBuilder(StateMgr.getSValBuilder()),
- currStmtIdx(0), currBldrCtx(0),
+ currStmtIdx(0), currBldrCtx(nullptr),
ObjCNoRet(mgr.getASTContext()),
ObjCGCEnabled(gcEnabled), BR(mgr, *this),
VisitedCallees(VisitedCalleesIn),
// top-level function. This is our starting assumption for
// analyzing an "open" program.
const StackFrameContext *SFC = InitLoc->getCurrentStackFrame();
- if (SFC->getParent() == 0) {
+ if (SFC->getParent() == nullptr) {
loc::MemRegionVal L = svalBuilder.getCXXThis(MD, SFC);
SVal V = state->getSVal(L);
if (Optional<Loc> LV = V.getAs<Loc>()) {
// Create a temporary object region for the inner expression (which may have
// a more derived type) and bind the value into it.
- const TypedValueRegion *TR = NULL;
+ const TypedValueRegion *TR = nullptr;
if (const MaterializeTemporaryExpr *MT =
dyn_cast<MaterializeTemporaryExpr>(Result)) {
StorageDuration SD = MT->getStorageDuration();
const Stmt *DiagnosticStmt,
ProgramPoint::Kind K) {
assert((K == ProgramPoint::PreStmtPurgeDeadSymbolsKind ||
- ReferenceStmt == 0 || isa<ReturnStmt>(ReferenceStmt))
+ ReferenceStmt == nullptr || isa<ReturnStmt>(ReferenceStmt))
&& "PostStmt is not generally supported by the SymbolReaper yet");
assert(LC && "Must pass the current (or expiring) LocationContext");
LC = LC->getParent();
}
- const StackFrameContext *SFC = LC ? LC->getCurrentStackFrame() : 0;
+ const StackFrameContext *SFC = LC ? LC->getCurrentStackFrame() : nullptr;
SymbolReaper SymReaper(SFC, ReferenceStmt, SymMgr, getStoreManager());
getCheckerManager().runCheckersForLiveSymbols(CleanedState, SymReaper);
// FIXME: Inlining of temporary destructors is not supported yet anyway, so we
// just put a NULL region for now. This will need to be changed later.
- VisitCXXDestructor(varType, NULL, D.getBindTemporaryExpr(),
+ VisitCXXDestructor(varType, nullptr, D.getBindTemporaryExpr(),
/*IsBase=*/ false, Pred, Dst);
}
it != et; ++it) {
ExplodedNode *N = *it;
const LocationContext *LCtx = N->getLocationContext();
- SVal result = svalBuilder.conjureSymbolVal(0, Ex, LCtx, resultType,
+ SVal result = svalBuilder.conjureSymbolVal(nullptr, Ex, LCtx,
+ resultType,
currBldrCtx->blockCount());
ProgramStateRef state = N->getState()->BindExpr(Ex, LCtx, result);
Bldr2.generateNode(S, N, state);
ProgramStateRef NewState =
createTemporaryRegionIfNeeded(State, LCtx, OCE->getArg(0));
if (NewState != State) {
- Pred = Bldr.generateNode(OCE, Pred, NewState, /*Tag=*/0,
+ Pred = Bldr.generateNode(OCE, Pred, NewState, /*Tag=*/nullptr,
ProgramPoint::PreStmtKind);
// Did we cache out?
if (!Pred)
const StackFrameContext *CalleeSF = CalleeLC->getCurrentStackFrame();
const StackFrameContext *CallerSF = CalleeSF->getParent()->getCurrentStackFrame();
assert(CalleeSF && CallerSF);
- ExplodedNode *BeforeProcessingCall = 0;
+ ExplodedNode *BeforeProcessingCall = nullptr;
const Stmt *CE = CalleeSF->getCallSite();
// Find the first node before we started processing the call expression.
while (N) {
ProgramPoint L = N->getLocation();
BeforeProcessingCall = N;
- N = N->pred_empty() ? NULL : *(N->pred_begin());
+ N = N->pred_empty() ? nullptr : *(N->pred_begin());
// Skip the nodes corresponding to the inlined code.
if (L.getLocationContext()->getCurrentStackFrame() != CallerSF)
builder.markInfeasible(false);
}
}
- currBldrCtx = 0;
+ currBldrCtx = nullptr;
}
/// The GDM component containing the set of global variables which have been
builder.generateNode(state, initHasRun, Pred);
builder.markInfeasible(!initHasRun);
- currBldrCtx = 0;
+ currBldrCtx = nullptr;
}
/// processIndirectGoto - Called by CoreEngine. Used to generate successor
}
else {
defaultIsFeasible = false;
- DefaultSt = NULL;
+ DefaultSt = nullptr;
}
}
V = UnknownVal();
}
- Bldr.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V), 0,
+ Bldr.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V), nullptr,
ProgramPoint::PostLValueKind);
return;
}
}
if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(D)) {
SVal V = svalBuilder.getFunctionPointer(FD);
- Bldr.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V), 0,
+ Bldr.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V), nullptr,
ProgramPoint::PostLValueKind);
return;
}
SVal V = svalBuilder.conjureSymbolVal(Ex, LCtx, getContext().VoidPtrTy,
currBldrCtx->blockCount());
state = state->assume(V.castAs<DefinedOrUnknownSVal>(), true);
- Bldr.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V), 0,
+ Bldr.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V), nullptr,
ProgramPoint::PostLValueKind);
return;
}
state->getSVal(Idx, LCtx),
state->getSVal(Base, LCtx));
assert(A->isGLValue());
- Bldr.generateNode(A, *it, state->BindExpr(A, LCtx, V), 0,
+ Bldr.generateNode(A, *it, state->BindExpr(A, LCtx, V), nullptr,
ProgramPoint::PostLValueKind);
}
}
L = UnknownVal();
}
- Bldr.generateNode(M, *I, state->BindExpr(M, LCtx, L), 0,
+ Bldr.generateNode(M, *I, state->BindExpr(M, LCtx, L), nullptr,
ProgramPoint::PostLValueKind);
} else {
Bldr.takeNodes(*I);
const InvalidatedSymbols &EscapedSymbols = Scanner.getSymbols();
State = getCheckerManager().runCheckersForPointerEscape(State,
EscapedSymbols,
- /*CallEvent*/ 0,
+ /*CallEvent*/ nullptr,
PSK_EscapeOnBind,
- 0);
+ nullptr);
return State;
}
if (!Call)
return getCheckerManager().runCheckersForPointerEscape(State,
*Invalidated,
- 0,
+ nullptr,
PSK_EscapeOther,
&ITraits);
// If the location is not a 'Loc', it will already be handled by
// the checkers. There is nothing left to do.
if (!location.getAs<Loc>()) {
- const ProgramPoint L = PostStore(StoreE, LC, /*Loc*/0, /*tag*/0);
+ const ProgramPoint L = PostStore(StoreE, LC, /*Loc*/nullptr,
+ /*tag*/nullptr);
ProgramStateRef state = Pred->getState();
state = processPointerEscapedOnBind(state, location, Val);
Bldr.generateNode(L, state, Pred);
state = state->bindLoc(location.castAs<Loc>(),
Val, /* notifyChanges = */ !atDeclInit);
- const MemRegion *LocReg = 0;
+ const MemRegion *LocReg = nullptr;
if (Optional<loc::MemRegionVal> LocRegVal =
location.getAs<loc::MemRegionVal>()) {
LocReg = LocRegVal->getRegion();
}
-
- const ProgramPoint L = PostStore(StoreE, LC, LocReg, 0);
+
+ const ProgramPoint L = PostStore(StoreE, LC, LocReg, nullptr);
Bldr.generateNode(L, state, PredI);
}
}
if (const CaseStmt *C = dyn_cast<CaseStmt>(Label)) {
Out << "\\lcase ";
LangOptions LO; // FIXME.
- C->getLHS()->printPretty(Out, 0, PrintingPolicy(LO));
+ C->getLHS()->printPretty(Out, nullptr, PrintingPolicy(LO));
if (const Stmt *RHS = C->getRHS()) {
Out << " .. ";
- RHS->printPretty(Out, 0, PrintingPolicy(LO));
+ RHS->printPretty(Out, nullptr, PrintingPolicy(LO));
}
Out << ":";
Out << S->getStmtClassName() << ' ' << (const void*) S << ' ';
LangOptions LO; // FIXME.
- S->printPretty(Out, 0, PrintingPolicy(LO));
+ S->printPretty(Out, nullptr, PrintingPolicy(LO));
printLocation(Out, S->getLocStart());
if (Loc.getAs<PreStmt>())
llvm::ViewGraph(*G.roots_begin(), "ExprEngine");
- GraphPrintCheckerState = NULL;
- GraphPrintSourceManager = NULL;
+ GraphPrintCheckerState = nullptr;
+ GraphPrintSourceManager = nullptr;
}
#endif
}
else
llvm::ViewGraph(*TrimmedG->roots_begin(), "TrimmedExprEngine");
- GraphPrintCheckerState = NULL;
- GraphPrintSourceManager = NULL;
+ GraphPrintCheckerState = nullptr;
+ GraphPrintSourceManager = nullptr;
#endif
}
// FIXME: Handle structs.
if (RightV.isUnknown()) {
unsigned Count = currBldrCtx->blockCount();
- RightV = svalBuilder.conjureSymbolVal(0, B->getRHS(), LCtx, Count);
+ RightV = svalBuilder.conjureSymbolVal(nullptr, B->getRHS(), LCtx,
+ Count);
}
// Simulate the effects of a "store": bind the value of the RHS
// to the L-Value represented by the LHS.
// The symbolic value is actually for the type of the left-hand side
// expression, not the computation type, as this is the value the
// LValue on the LHS will bind to.
- LHSVal = svalBuilder.conjureSymbolVal(0, B->getRHS(), LCtx, LTy,
+ LHSVal = svalBuilder.conjureSymbolVal(nullptr, B->getRHS(), LCtx, LTy,
currBldrCtx->blockCount());
// However, we need to convert the symbol to the computation type.
Result = svalBuilder.evalCast(LHSVal, CTy, LTy);
StmtNodeBuilder Bldr(Pred, Tmp, *currBldrCtx);
Bldr.generateNode(BE, Pred,
State->BindExpr(BE, Pred->getLocationContext(), V),
- 0, ProgramPoint::PostLValueKind);
-
+ nullptr, ProgramPoint::PostLValueKind);
+
// FIXME: Move all post/pre visits to ::Visit().
getCheckerManager().runCheckersForPostStmt(Dst, Tmp, BE, *this);
}
// If we don't know if the cast succeeded, conjure a new symbol.
if (val.isUnknown()) {
DefinedOrUnknownSVal NewSym =
- svalBuilder.conjureSymbolVal(0, CastE, LCtx, resultType,
+ svalBuilder.conjureSymbolVal(nullptr, CastE, LCtx, resultType,
currBldrCtx->blockCount());
state = state->BindExpr(CastE, LCtx, NewSym);
} else
QualType resultType = CastE->getType();
if (CastE->isGLValue())
resultType = getContext().getPointerType(resultType);
- SVal result = svalBuilder.conjureSymbolVal(0, CastE, LCtx,
+ SVal result = svalBuilder.conjureSymbolVal(nullptr, CastE, LCtx,
resultType,
currBldrCtx->blockCount());
state = state->BindExpr(CastE, LCtx, result);
Ty = getContext().getPointerType(Ty);
}
- InitVal = svalBuilder.conjureSymbolVal(0, InitEx, LC, Ty,
+ InitVal = svalBuilder.conjureSymbolVal(nullptr, InitEx, LC, Ty,
currBldrCtx->blockCount());
}
StmtNodeBuilder B(Pred, Dst, *currBldrCtx);
ProgramStateRef state = Pred->getState();
const LocationContext *LCtx = Pred->getLocationContext();
- const CFGBlock *SrcBlock = 0;
+ const CFGBlock *SrcBlock = nullptr;
// Find the predecessor block.
ProgramStateRef SrcState = state;
}
if (!hasValue)
- V = svalBuilder.conjureSymbolVal(0, Ex, LCtx, currBldrCtx->blockCount());
+ V = svalBuilder.conjureSymbolVal(nullptr, Ex, LCtx,
+ currBldrCtx->blockCount());
// Generate a new node with the binding from the appropriate path.
B.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V, true));
// Conjure a new symbol if necessary to recover precision.
if (Result.isUnknown()){
DefinedOrUnknownSVal SymVal =
- svalBuilder.conjureSymbolVal(0, Ex, LCtx, currBldrCtx->blockCount());
+ svalBuilder.conjureSymbolVal(nullptr, Ex, LCtx,
+ currBldrCtx->blockCount());
Result = SymVal;
// If the value is a location, ++/-- should always preserve
const LocationContext *LCtx = Pred->getLocationContext();
ProgramStateRef State = Pred->getState();
- const MemRegion *Target = 0;
+ const MemRegion *Target = nullptr;
// FIXME: Handle arrays, which run the same constructor for every element.
// For now, we just run the first constructor (which should still invalidate
// since it's then possible to be initializing one part of a multi-
// dimensional array.
State = State->bindDefault(loc::MemRegionVal(Target), ZeroVal);
- Bldr.generateNode(CE, *I, State, /*tag=*/0, ProgramPoint::PreStmtKind);
+ Bldr.generateNode(CE, *I, State, /*tag=*/nullptr,
+ ProgramPoint::PreStmtKind);
}
}
}
if (IsStandardGlobalOpNewFunction)
symVal = svalBuilder.getConjuredHeapSymbolVal(CNE, LCtx, blockCount);
else
- symVal = svalBuilder.conjureSymbolVal(0, CNE, LCtx, CNE->getType(),
+ symVal = svalBuilder.conjureSymbolVal(nullptr, CNE, LCtx, CNE->getType(),
blockCount);
ProgramStateRef State = Pred->getState();
// corresponding Block.
static std::pair<const Stmt*,
const CFGBlock*> getLastStmt(const ExplodedNode *Node) {
- const Stmt *S = 0;
- const CFGBlock *Blk = 0;
+ const Stmt *S = nullptr;
+ const CFGBlock *Blk = nullptr;
const StackFrameContext *SF =
Node->getLocation().getLocationContext()->getCurrentStackFrame();
}
if (Node->pred_empty())
- return std::pair<const Stmt*, const CFGBlock*>((Stmt*)0, (CFGBlock*)0);
+ return std::make_pair(nullptr, nullptr);
Node = *Node->pred_begin();
}
- return std::pair<const Stmt*, const CFGBlock*>(S, Blk);
+ return std::make_pair(S, Blk);
}
/// Adjusts a return value when the called function's return type does not
ExplodedNode *Pred,
ExplodedNodeSet &Dst) {
// Find the last statement in the function and the corresponding basic block.
- const Stmt *LastSt = 0;
- const CFGBlock *Blk = 0;
+ const Stmt *LastSt = nullptr;
+ const CFGBlock *Blk = nullptr;
std::tie(LastSt, Blk) = getLastStmt(Pred);
if (!Blk || !LastSt) {
Dst.Add(Pred);
const Stmt *CE = calleeCtx->getCallSite();
ProgramStateRef state = CEBNode->getState();
// Find the last statement in the function and the corresponding basic block.
- const Stmt *LastSt = 0;
- const CFGBlock *Blk = 0;
+ const Stmt *LastSt = nullptr;
+ const CFGBlock *Blk = nullptr;
std::tie(LastSt, Blk) = getLastStmt(CEBNode);
// Generate a CallEvent /before/ cleaning the state, so that we can get the
// context, telling it to clean up everything in the callee's context
// (and its children). We use the callee's function body as a diagnostic
// statement, with which the program point will be associated.
- removeDead(BindedRetNode, CleanedNodes, 0, calleeCtx,
+ removeDead(BindedRetNode, CleanedNodes, nullptr, calleeCtx,
calleeCtx->getAnalysisDeclContext()->getBody(),
ProgramPoint::PostStmtPurgeDeadSymbolsKind);
- currBldrCtx = 0;
+ currBldrCtx = nullptr;
} else {
CleanedNodes.Add(CEBNode);
}
const Stmt *CallE) {
const void *ReplayState = State->get<ReplayWithoutInlining>();
if (!ReplayState)
- return 0;
+ return nullptr;
assert(ReplayState == CallE && "Backtracked to the wrong call.");
(void)CallE;
QualType ResultTy = Call.getResultType();
SValBuilder &SVB = getSValBuilder();
unsigned Count = currBldrCtx->blockCount();
- SVal R = SVB.conjureSymbolVal(0, E, LCtx, ResultTy, Count);
+ SVal R = SVB.conjureSymbolVal(nullptr, E, LCtx, ResultTy, Count);
return State->BindExpr(E, LCtx, R);
}
if (const DeclStmt *DS = dyn_cast<DeclStmt>(elem)) {
const VarDecl *elemD = cast<VarDecl>(DS->getSingleDecl());
- assert(elemD->getInit() == 0);
+ assert(elemD->getInit() == nullptr);
elementV = state->getLValue(elemD, Pred->getLocationContext());
}
else {
}
ExplodedNodeSet dstLocation;
- evalLocation(dstLocation, S, elem, Pred, state, elementV, NULL, false);
+ evalLocation(dstLocation, S, elem, Pred, state, elementV, nullptr, false);
ExplodedNodeSet Tmp;
StmtNodeBuilder Bldr(Pred, Tmp, *currBldrCtx);
public:
HTMLDiagnostics(const std::string& prefix, const Preprocessor &pp);
- virtual ~HTMLDiagnostics() { FlushDiagnostics(NULL); }
+ virtual ~HTMLDiagnostics() { FlushDiagnostics(nullptr); }
void FlushDiagnosticsImpl(std::vector<const PathDiagnostic *> &Diags,
FilesMade *filesMade) override;
// Create the html for the message.
- const char *Kind = 0;
+ const char *Kind = nullptr;
switch (P.getKind()) {
case PathDiagnosticPiece::Call:
llvm_unreachable("Calls should already be handled");
bool SubRegion::isSubRegionOf(const MemRegion* R) const {
const MemRegion* r = getSuperRegion();
- while (r != 0) {
+ while (r != nullptr) {
if (r == R)
return true;
if (const SubRegion* sr = dyn_cast<SubRegion>(r))
const StackFrameContext *VarRegion::getStackFrame() const {
const StackSpaceRegion *SSR = dyn_cast<StackSpaceRegion>(getMemorySpace());
- return SSR ? SSR->getStackFrame() : NULL;
+ return SSR ? SSR->getStackFrame() : nullptr;
}
//===----------------------------------------------------------------------===//
}
void StringRegion::dumpToStream(raw_ostream &os) const {
- Str->printPretty(os, 0, PrintingPolicy(getContext().getLangOpts()));
+ Str->printPretty(os, nullptr, PrintingPolicy(getContext().getLangOpts()));
}
void ObjCStringRegion::dumpToStream(raw_ostream &os) const {
- Str->printPretty(os, 0, PrintingPolicy(getContext().getLangOpts()));
+ Str->printPretty(os, nullptr, PrintingPolicy(getContext().getLangOpts()));
}
void SymbolicRegion::dumpToStream(raw_ostream &os) const {
LC = LC->getParent();
}
- return (const StackFrameContext*)0;
+ return (const StackFrameContext *)nullptr;
}
const VarRegion* MemRegionManager::getVarRegion(const VarDecl *D,
const LocationContext *LC) {
- const MemRegion *sReg = 0;
+ const MemRegion *sReg = nullptr;
if (D->hasGlobalStorage() && !D->isStaticLocal()) {
MemRegionManager::getBlockDataRegion(const BlockTextRegion *BC,
const LocationContext *LC,
unsigned blockCount) {
- const MemRegion *sReg = 0;
+ const MemRegion *sReg = nullptr;
const BlockDecl *BD = BC->getDecl();
if (!BD->hasCaptures()) {
// This handles 'static' blocks.
const CXXTempObjectRegion *
MemRegionManager::getCXXStaticTempObjectRegion(const Expr *Ex) {
return getSubRegion<CXXTempObjectRegion>(
- Ex, getGlobalsRegion(MemRegion::GlobalInternalSpaceRegionKind, NULL));
+ Ex, getGlobalsRegion(MemRegion::GlobalInternalSpaceRegionKind, nullptr));
}
const CompoundLiteralRegion*
MemRegionManager::getCompoundLiteralRegion(const CompoundLiteralExpr *CL,
const LocationContext *LC) {
- const MemRegion *sReg = 0;
+ const MemRegion *sReg = nullptr;
if (CL->isFileScope())
sReg = getGlobalsRegion();
return SymR;
SubR = dyn_cast<SubRegion>(SubR->getSuperRegion());
}
- return 0;
+ return nullptr;
}
// FIXME: Merge with the implementation of the same method in Store.cpp
RegionRawOffset ElementRegion::getAsArrayOffset() const {
CharUnits offset = CharUnits::Zero();
const ElementRegion *ER = this;
- const MemRegion *superR = NULL;
+ const MemRegion *superR = nullptr;
ASTContext &C = getContext();
// FIXME: Handle multi-dimensional arrays.
continue;
}
- return NULL;
+ return nullptr;
}
assert(superR && "super region cannot be NULL");
RegionOffset MemRegion::getAsOffset() const {
const MemRegion *R = this;
- const MemRegion *SymbolicOffsetBase = 0;
+ const MemRegion *SymbolicOffsetBase = nullptr;
int64_t Offset = 0;
while (1) {
std::pair<const VarRegion *, const VarRegion *>
BlockDataRegion::getCaptureRegions(const VarDecl *VD) {
MemRegionManager &MemMgr = *getMemRegionManager();
- const VarRegion *VR = 0;
- const VarRegion *OriginalVR = 0;
+ const VarRegion *VR = nullptr;
+ const VarRegion *OriginalVR = nullptr;
if (!VD->hasAttr<BlocksAttr>() && VD->hasLocalStorage()) {
VR = MemMgr.getVarRegion(VD, this);
new (BVOriginal) VarVec(BC, E - I);
for ( ; I != E; ++I) {
- const VarRegion *VR = 0;
- const VarRegion *OriginalVR = 0;
+ const VarRegion *VR = nullptr;
+ const VarRegion *OriginalVR = nullptr;
std::tie(VR, OriginalVR) = getCaptureRegions(*I);
assert(VR);
assert(OriginalVR);
static_cast<BumpVector<const MemRegion*>*>(ReferencedVars);
if (Vec == (void*) 0x1)
- return BlockDataRegion::referenced_vars_iterator(0, 0);
-
+ return BlockDataRegion::referenced_vars_iterator(nullptr, nullptr);
+
BumpVector<const MemRegion*> *VecOriginal =
static_cast<BumpVector<const MemRegion*>*>(OriginalVars);
static_cast<BumpVector<const MemRegion*>*>(ReferencedVars);
if (Vec == (void*) 0x1)
- return BlockDataRegion::referenced_vars_iterator(0, 0);
-
+ return BlockDataRegion::referenced_vars_iterator(nullptr, nullptr);
+
BumpVector<const MemRegion*> *VecOriginal =
static_cast<BumpVector<const MemRegion*>*>(OriginalVars);
if (I.getCapturedRegion() == R)
return I.getOriginalRegion();
}
- return 0;
+ return nullptr;
}
//===----------------------------------------------------------------------===//
// If the call is within a macro, don't do anything (for now).
if (CallLoc.isMacroID())
- return 0;
+ return nullptr;
assert(SMgr.isInMainFile(CallLoc) &&
"The call piece should be in the main file.");
const PathPieces &Path = CP->path;
if (Path.empty())
- return 0;
+ return nullptr;
// Check if the last piece in the callee path is a call to a function outside
// of the main file.
}
// Otherwise, the last piece is in the main file.
- return 0;
+ return nullptr;
}
void PathDiagnostic::resetDiagnosticLocationToMainFile() {
// Profile the node to see if we already have something matching it
llvm::FoldingSetNodeID profile;
D->Profile(profile);
- void *InsertPos = 0;
+ void *InsertPos = nullptr;
if (PathDiagnostic *orig = Diags.FindNodeOrInsertPos(profile, InsertPos)) {
// Keep the PathDiagnostic with the shorter path.
void *InsertPos;
PDFileEntry *Entry = FindNodeOrInsertPos(NodeID, InsertPos);
if (!Entry)
- return 0;
+ return nullptr;
return &Entry->files;
}
PathDiagnosticLocation::create(const ProgramPoint& P,
const SourceManager &SMng) {
- const Stmt* S = 0;
+ const Stmt* S = nullptr;
if (Optional<BlockEdge> BE = P.getAs<BlockEdge>()) {
const CFGBlock *BSrc = BE->getSrc();
S = BSrc->getTerminatorCondition();
if (Optional<PostInitializer> PIPP = P.getAs<PostInitializer>())
return PIPP->getInitializer()->getInit();
- return 0;
+ return nullptr;
}
const Stmt *PathDiagnosticLocation::getNextStmt(const ExplodedNode *N) {
}
}
- return 0;
+ return nullptr;
}
PathDiagnosticLocation
void PathDiagnosticLocation::flatten() {
if (K == StmtK) {
K = RangeK;
- S = 0;
- D = 0;
+ S = nullptr;
+ D = nullptr;
}
else if (K == DeclK) {
K = SingleLocK;
- S = 0;
- D = 0;
+ S = nullptr;
+ D = nullptr;
}
}
IntrusiveRefCntPtr<PathDiagnosticEventPiece>
PathDiagnosticCallPiece::getCallEnterEvent() const {
if (!Callee)
- return 0;
+ return nullptr;
SmallString<256> buf;
llvm::raw_svector_ostream Out(buf);
IntrusiveRefCntPtr<PathDiagnosticEventPiece>
PathDiagnosticCallPiece::getCallEnterWithinCallerEvent() const {
if (!callEnterWithin.asLocation().isValid())
- return 0;
+ return nullptr;
if (Callee->isImplicit() || !Callee->hasBody())
- return 0;
+ return nullptr;
if (const CXXMethodDecl *MD = dyn_cast<CXXMethodDecl>(Callee))
if (MD->isDefaulted())
- return 0;
+ return nullptr;
SmallString<256> buf;
llvm::raw_svector_ostream Out(buf);
IntrusiveRefCntPtr<PathDiagnosticEventPiece>
PathDiagnosticCallPiece::getCallExitEvent() const {
if (NoExit)
- return 0;
+ return nullptr;
SmallString<256> buf;
llvm::raw_svector_ostream Out(buf);
// ranges of the diagnostics.
FIDMap FM;
SmallVector<FileID, 10> Fids;
- const SourceManager* SM = 0;
+ const SourceManager* SM = nullptr;
if (!Diags.empty())
SM = &(*(*Diags.begin())->path.begin())->getLocation().getManager();
const StoreRef &newStore =
Mgr.StoreMgr->invalidateRegions(getStore(), Values, E, Count, LCtx, Call,
- *IS, *ITraits, NULL, NULL);
+ *IS, *ITraits, nullptr, nullptr);
return makeWithStore(newStore);
}
if (ProgramState *I = StateSet.FindNodeOrInsertPos(ID, InsertPos))
return I;
- ProgramState *newState = 0;
+ ProgramState *newState = nullptr;
if (!freeStates.empty()) {
newState = freeStates.back();
freeStates.pop_back();
return *second;
}
const llvm::APSInt *getConcreteValue() const {
- return &From() == &To() ? &From() : NULL;
+ return &From() == &To() ? &From() : nullptr;
}
void Profile(llvm::FoldingSetNodeID &ID) const {
/// constant then this method returns that value. Otherwise, it returns
/// NULL.
const llvm::APSInt* getConcreteValue() const {
- return ranges.isSingleton() ? ranges.begin()->getConcreteValue() : 0;
+ return ranges.isSingleton() ? ranges.begin()->getConcreteValue() : nullptr;
}
private:
const llvm::APSInt* RangeConstraintManager::getSymVal(ProgramStateRef St,
SymbolRef sym) const {
const ConstraintRangeTy::data_type *T = St->get<ConstraintRange>(sym);
- return T ? T->getConcreteValue() : NULL;
+ return T ? T->getConcreteValue() : nullptr;
}
ConditionTruthVal RangeConstraintManager::checkNull(ProgramStateRef State,
// [Int-Adjustment+1, Int-Adjustment-1]
// Notice that the lower bound is greater than the upper bound.
RangeSet New = GetRange(St, Sym).Intersect(getBasicVals(), F, Upper, Lower);
- return New.isEmpty() ? NULL : St->set<ConstraintRange>(Sym, New);
+ return New.isEmpty() ? nullptr : St->set<ConstraintRange>(Sym, New);
}
ProgramStateRef
// Before we do any real work, see if the value can even show up.
APSIntType AdjustmentType(Adjustment);
if (AdjustmentType.testInRange(Int, true) != APSIntType::RTR_Within)
- return NULL;
+ return nullptr;
// [Int-Adjustment, Int-Adjustment]
llvm::APSInt AdjInt = AdjustmentType.convert(Int) - Adjustment;
RangeSet New = GetRange(St, Sym).Intersect(getBasicVals(), F, AdjInt, AdjInt);
- return New.isEmpty() ? NULL : St->set<ConstraintRange>(Sym, New);
+ return New.isEmpty() ? nullptr : St->set<ConstraintRange>(Sym, New);
}
ProgramStateRef
APSIntType AdjustmentType(Adjustment);
switch (AdjustmentType.testInRange(Int, true)) {
case APSIntType::RTR_Below:
- return NULL;
+ return nullptr;
case APSIntType::RTR_Within:
break;
case APSIntType::RTR_Above:
llvm::APSInt ComparisonVal = AdjustmentType.convert(Int);
llvm::APSInt Min = AdjustmentType.getMinValue();
if (ComparisonVal == Min)
- return NULL;
+ return nullptr;
llvm::APSInt Lower = Min-Adjustment;
llvm::APSInt Upper = ComparisonVal-Adjustment;
--Upper;
RangeSet New = GetRange(St, Sym).Intersect(getBasicVals(), F, Lower, Upper);
- return New.isEmpty() ? NULL : St->set<ConstraintRange>(Sym, New);
+ return New.isEmpty() ? nullptr : St->set<ConstraintRange>(Sym, New);
}
ProgramStateRef
case APSIntType::RTR_Within:
break;
case APSIntType::RTR_Above:
- return NULL;
+ return nullptr;
}
// Special case for Int == Max. This is always false.
llvm::APSInt ComparisonVal = AdjustmentType.convert(Int);
llvm::APSInt Max = AdjustmentType.getMaxValue();
if (ComparisonVal == Max)
- return NULL;
+ return nullptr;
llvm::APSInt Lower = ComparisonVal-Adjustment;
llvm::APSInt Upper = Max-Adjustment;
++Lower;
RangeSet New = GetRange(St, Sym).Intersect(getBasicVals(), F, Lower, Upper);
- return New.isEmpty() ? NULL : St->set<ConstraintRange>(Sym, New);
+ return New.isEmpty() ? nullptr : St->set<ConstraintRange>(Sym, New);
}
ProgramStateRef
case APSIntType::RTR_Within:
break;
case APSIntType::RTR_Above:
- return NULL;
+ return nullptr;
}
// Special case for Int == Min. This is always feasible.
llvm::APSInt Upper = Max-Adjustment;
RangeSet New = GetRange(St, Sym).Intersect(getBasicVals(), F, Lower, Upper);
- return New.isEmpty() ? NULL : St->set<ConstraintRange>(Sym, New);
+ return New.isEmpty() ? nullptr : St->set<ConstraintRange>(Sym, New);
}
ProgramStateRef
APSIntType AdjustmentType(Adjustment);
switch (AdjustmentType.testInRange(Int, true)) {
case APSIntType::RTR_Below:
- return NULL;
+ return nullptr;
case APSIntType::RTR_Within:
break;
case APSIntType::RTR_Above:
llvm::APSInt Upper = ComparisonVal-Adjustment;
RangeSet New = GetRange(St, Sym).Intersect(getBasicVals(), F, Lower, Upper);
- return New.isEmpty() ? NULL : St->set<ConstraintRange>(Sym, New);
+ return New.isEmpty() ? nullptr : St->set<ConstraintRange>(Sym, New);
}
//===------------------------------------------------------------------------===
const SVal *RegionBindingsRef::lookup(BindingKey K) const {
const ClusterBindings *Cluster = lookup(K.getBaseRegion());
if (!Cluster)
- return 0;
+ return nullptr;
return Cluster->lookup(K);
}
// getBindingForField if 'R' has a direct binding.
// Lazy binding?
- Store lazyBindingStore = NULL;
- const SubRegion *lazyBindingRegion = NULL;
+ Store lazyBindingStore = nullptr;
+ const SubRegion *lazyBindingRegion = nullptr;
std::tie(lazyBindingStore, lazyBindingRegion) = findLazyBinding(B, R, R);
if (lazyBindingRegion)
return getLazyBinding(lazyBindingRegion,
if (const SymbolicRegion *SR = *I) {
if (SymReaper.isLive(SR->getSymbol())) {
changed |= AddToWorkList(SR);
- *I = NULL;
+ *I = nullptr;
}
}
}
return FD;
}
- return 0;
+ return nullptr;
}
/// \brief If this SVal is a location (subclasses Loc) and wraps a symbol,
dyn_cast<SymbolicRegion>(R->StripCasts()))
return SymR->getSymbol();
}
- return 0;
+ return nullptr;
}
/// Get the symbol in the SVal or its base region.
Optional<loc::MemRegionVal> X = getAs<loc::MemRegionVal>();
if (!X)
- return 0;
+ return nullptr;
const MemRegion *R = X->getRegion();
R = SR->getSuperRegion();
}
- return 0;
+ return nullptr;
}
// TODO: The next 3 functions have to be simplified.
if (Optional<nonloc::LocAsInteger> X = getAs<nonloc::LocAsInteger>())
return X->getLoc().getAsRegion();
- return 0;
+ return nullptr;
}
const MemRegion *loc::MemRegionVal::stripCasts(bool StripBaseCasts) const {
const MemRegion *R = getRegion();
- return R ? R->StripCasts(StripBaseCasts) : NULL;
+ return R ? R->StripCasts(StripBaseCasts) : nullptr;
}
const void *nonloc::LazyCompoundVal::getStore() const {
case nonloc::ConcreteIntKind: {
bool b = Cond.castAs<nonloc::ConcreteInt>().getValue() != 0;
bool isFeasible = b ? Assumption : !Assumption;
- return isFeasible ? state : NULL;
+ return isFeasible ? state : nullptr;
}
case nonloc::LocAsIntegerKind:
RegionOffset LeftOffset = LeftMR->getAsOffset();
RegionOffset RightOffset = RightMR->getAsOffset();
- if (LeftOffset.getRegion() != NULL &&
+ if (LeftOffset.getRegion() != nullptr &&
LeftOffset.getRegion() == RightOffset.getRegion() &&
!LeftOffset.hasSymbolicOffset() && !RightOffset.hasSymbolicOffset()) {
int64_t left = LeftOffset.getOffset();
if (const MemRegion *region = lhs.getAsRegion()) {
rhs = convertToArrayIndex(rhs).castAs<NonLoc>();
SVal index = UnknownVal();
- const MemRegion *superR = 0;
+ const MemRegion *superR = nullptr;
QualType elementType;
if (const ElementRegion *elemReg = dyn_cast<ElementRegion>(region)) {
const llvm::APSInt *SimpleSValBuilder::getKnownValue(ProgramStateRef state,
SVal V) {
if (V.isUnknownOrUndef())
- return NULL;
+ return nullptr;
if (Optional<loc::ConcreteInt> X = V.getAs<loc::ConcreteInt>())
return &X->getValue();
return state->getConstraintManager().getSymVal(state, Sym);
// FIXME: Add support for SymExprs.
- return NULL;
+ return nullptr;
}
// We don't know what to make of it. Return a NULL region, which
// will be interpretted as UnknownVal.
- return NULL;
+ return nullptr;
}
// Now assume we are casting from pointer to pointer. Other cases should
// If we cannot compute a raw offset, throw up our hands and return
// a NULL MemRegion*.
if (!baseR)
- return NULL;
+ return nullptr;
CharUnits off = rawOff.getOffset();
// Compute the index for the new ElementRegion.
int64_t newIndex = 0;
- const MemRegion *newSuperR = 0;
+ const MemRegion *newSuperR = nullptr;
// We can only compute sizeof(PointeeTy) if it is a complete type.
if (IsCompleteType(Ctx, PointeeTy)) {
return TVR->getValueType()->getAsCXXRecordDecl();
if (const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(MR))
return SR->getSymbol()->getType()->getPointeeCXXRecordDecl();
- return 0;
+ return nullptr;
}
SVal StoreManager::evalDynamicCast(SVal Base, QualType TargetType,
return Base;
Loc BaseL = Base.castAs<Loc>();
- const MemRegion* BaseR = 0;
+ const MemRegion* BaseR = nullptr;
switch (BaseL.getSubKind()) {
case loc::MemRegionKind:
void SymbolManager::addSymbolDependency(const SymbolRef Primary,
const SymbolRef Dependent) {
SymbolDependTy::iterator I = SymbolDependencies.find(Primary);
- SymbolRefSmallVectorTy *dependencies = 0;
+ SymbolRefSmallVectorTy *dependencies = nullptr;
if (I == SymbolDependencies.end()) {
dependencies = new SymbolRefSmallVectorTy();
SymbolDependencies[Primary] = dependencies;
const SymbolRef Primary) {
SymbolDependTy::const_iterator I = SymbolDependencies.find(Primary);
if (I == SymbolDependencies.end())
- return 0;
+ return nullptr;
return I->second;
}
bool
SymbolReaper::isLive(const Stmt *ExprVal, const LocationContext *ELCtx) const {
- if (LCtx == 0)
+ if (LCtx == nullptr)
return false;
if (LCtx != ELCtx) {
const std::string& outdir,
AnalyzerOptionsRef opts,
ArrayRef<std::string> plugins)
- : RecVisitorMode(0), RecVisitorBR(0),
- Ctx(0), PP(pp), OutDir(outdir), Opts(opts), Plugins(plugins) {
+ : RecVisitorMode(0), RecVisitorBR(nullptr),
+ Ctx(nullptr), PP(pp), OutDir(outdir), Opts(opts), Plugins(plugins) {
DigestAnalyzerOptions();
if (Opts->PrintStats) {
llvm::EnableStatistics();
/// given root function.
void HandleCode(Decl *D, AnalysisMode Mode,
ExprEngine::InliningModes IMode = ExprEngine::Inline_Minimal,
- SetOfConstDecls *VisitedCallees = 0);
+ SetOfConstDecls *VisitedCallees = nullptr);
void RunPathSensitiveChecks(Decl *D,
ExprEngine::InliningModes IMode,
//===----------------------------------------------------------------------===//
// AnalysisConsumer implementation.
//===----------------------------------------------------------------------===//
-llvm::Timer* AnalysisConsumer::TUTotalTimer = 0;
+llvm::Timer* AnalysisConsumer::TUTotalTimer = nullptr;
bool AnalysisConsumer::HandleTopLevelDecl(DeclGroupRef DG) {
storeTopLevelDecls(DG);
SetOfConstDecls VisitedCallees;
HandleCode(D, AM_Path, getInliningModeForFunction(D, Visited),
- (Mgr->options.InliningMode == All ? 0 : &VisitedCallees));
+ (Mgr->options.InliningMode == All ? nullptr : &VisitedCallees));
// Add the visited callees to the global visited set.
for (SetOfConstDecls::iterator I = VisitedCallees.begin(),
// After all decls handled, run checkers on the entire TranslationUnit.
checkerMgr->runCheckersOnEndOfTranslationUnit(TU, *Mgr, BR);
- RecVisitorBR = 0;
+ RecVisitorBR = nullptr;
}
// Explicitly destroy the PathDiagnosticConsumer. This will flush its output.
// FIXME: This should be replaced with something that doesn't rely on
// side-effects in PathDiagnosticConsumer's destructor. This is required when
// used with option -disable-free.
- Mgr.reset(NULL);
+ Mgr.reset(nullptr);
if (TUTotalTimer) TUTotalTimer->stopTimer();
// Release the auditor (if any) so that it doesn't monitor the graph
// created BugReporter.
- ExplodedNode::SetAuditor(0);
+ ExplodedNode::SetAuditor(nullptr);
// Visualize the exploded graph.
if (Mgr->options.visualizeExplodedGraphWithGraphViz)
}
UbigraphViz::~UbigraphViz() {
- Out.reset(0);
+ Out.reset(nullptr);
llvm::errs() << "Running 'ubiviz' program... ";
std::string ErrMsg;
std::string Ubiviz = llvm::sys::FindProgramByName("ubiviz");
std::vector<const char*> args;
args.push_back(Ubiviz.c_str());
args.push_back(Filename.c_str());
- args.push_back(0);
+ args.push_back(nullptr);
- if (llvm::sys::ExecuteAndWait(Ubiviz, &args[0], 0, 0, 0, 0, &ErrMsg)) {
+ if (llvm::sys::ExecuteAndWait(Ubiviz, &args[0], nullptr, nullptr, 0, 0,
+ &ErrMsg)) {
llvm::errs() << "Error viewing graph: " << ErrMsg << "\n";
}
public:
ClangCheckerRegistry(ArrayRef<std::string> plugins,
- DiagnosticsEngine *diags = 0);
+ DiagnosticsEngine *diags = nullptr);
};
} // end anonymous namespace
bool ClangCheckerRegistry::isCompatibleAPIVersion(const char *versionString) {
// If the version string is null, it's not an analyzer plugin.
- if (versionString == 0)
+ if (!versionString)
return false;
// For now, none of the static analyzer API is considered stable.